Sonatype Nexus Repository Manager before 3.14 allows Java Expression Language Injection.
References
Link | Resource |
---|---|
https://securitylab.github.com/advisories/GHSL-2020-015-nxrm-sonatype | Exploit Third Party Advisory |
https://support.sonatype.com/hc/en-us/articles/360010789153-CVE-2018-16621-Nexus-Repository-Manager-Java-Injection-October-17-2018 | Patch Vendor Advisory |
Configurations
History
04 Mar 2021, 21:06
Type | Values Removed | Values Added |
---|---|---|
References | (MISC) https://securitylab.github.com/advisories/GHSL-2020-015-nxrm-sonatype - Exploit, Third Party Advisory |
22 Feb 2021, 02:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
Information
Published : 2018-11-15 20:29
Updated : 2023-12-10 12:44
NVD link : CVE-2018-16621
Mitre link : CVE-2018-16621
CVE.ORG link : CVE-2018-16621
JSON object : View
Products Affected
sonatype
- nexus_repository_manager
CWE
CWE-917
Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')