PT-2019-6220 · Sonatype · Sonatype Nexus Repository Manager+1

Publicado 2019-03-21 · Atualizado 2025-11-06 · CVE-2019-7238

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Sonatype Nexus Repository Manager versions prior to 3.15.0

Description The issue is related to incorrect access control in the Sonatype Nexus Repository Manager, which can be exploited by a remote attacker to execute arbitrary code. This is due to insecure privilege management.

Recommendations For versions prior to 3.15.0, update to version 3.15.0 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive areas of the repository manager to minimize the risk of exploitation.

Exploit

Correção

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

BDU:2022-04016

CVE-2019-7238

Produtos afetados

Nexus Repository Manager

Sonatype Nexus Repository Manager

Referências · 15

• 🔥 https://github.com/mpgn/CVE-2019-7238 · Exploit
• 🔥 https://github.com/jas502n/CVE-2019-7238 · Exploit
• 🔥 https://github.com/verctor/nexus_rce_CVE-2019-7238 · Exploit
• 🔥 https://github.com/magicming200/CVE-2019-7238_Nexus_RCE_Tool · Exploit
• https://t.me/cveNotify/141971 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2022-04016 · Nota de Segurança
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-7238 · Nota
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Nota
• https://t.me/cveNotify/141954 · Publicação no Telegram
• https://t.me/defcon_news/22216 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2019-7238 · Nota de Segurança
• https://support.sonatype.com/hc/en-us/articles/360017310793-CVE-2019-7238-Nexus-Repository-Manager-3-Missing-Access-Controls-and-Remote-Code-Execution-February-5th-2019 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-7238 · Aviso do Fabricante
• https://cisa.gov/known-exploited-vulnerabilities-catalog · Nota
• https://blogs.juniper.net/en-us/threat-research/sysrv-botnet-expands-and-gains-persistence · Nota