PT-2019-17696 · Sonatype · Nexus Yum Repository Plugin+1

Publicado 2019-09-03 · Atualizado 2019-11-01 · CVE-2019-5475

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Nexus Yum Repository Plugin version v2

Description The issue allows for Remote Code Execution when instances using CommandLineExecutor.java are supplied vulnerable data, such as the Yum Configuration Capability.

Recommendations For Nexus Yum Repository Plugin version v2, consider restricting the use of CommandLineExecutor.java until a patch is available to prevent Remote Code Execution. Avoid supplying vulnerable data, such as the Yum Configuration Capability, to minimize the risk of exploitation.

Exploit

Correção

RCE

OS Command Injection

Command Injection

Enumeração de Fraquezas

CWE-78

CWE-77

Identificadores relacionados

BDU:2023-00715

CVE-2019-5475

GHSA-G5M7-57PH-J6P8

Produtos afetados

Nexus Repository Manager

Nexus Yum Repository Plugin

Referências · 12

• 🔥 https://github.com/rabbitmask/CVE-2019-5475-EXP · Exploit
• 🔥 https://github.com/jaychouzzk/CVE-2019-5475-Nexus-Repository-Manager- · Exploit
• 🔥 https://github.com/lyy289065406/CVE-2019-5475 · Exploit
• 🔥 https://github.com/EXP-Docs/CVE-2019-5475 · Exploit
• 🔥 https://hackerone.com/reports/654888 · Exploit
• https://osv.dev/vulnerability/GHSA-g5m7-57ph-j6p8 · Aviso do Fabricante
• https://support.sonatype.com/hc/en-us/articles/360033490774-CVE-2019-5475-Nexus-Repository-Manager-2-OS-Command-Injection-2019-08-09 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-5475 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-5475 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-00715 · Nota de Segurança
• https://hackerone.com/reports/688270 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-15588 · Nota de Segurança