PT-2014-4440 · Sonatype · Sonatype Nexus+1

Published 2014-04-01 · Updated 2014-04-01 · CVE-2014-2034

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Sonatype Nexus versions 2.4.0 through 2.7.1

Description The issue allows attackers to create arbitrary user accounts via an unauthenticated execution path.

Recommendations For versions 2.4.0 through 2.7.1, update to a version outside of the affected range to resolve the issue.

Fix

Related Identifiers

CVE-2014-2034

Affected Products

Nexus Repository Manager

Sonatype Nexus

References · 6

• https://support.sonatype.com/entries/42374566-CVE-2014-2034-Nexus-Security-Advisory-REST-API · Vendor Advisory
• http://sonatype.org/advisories/archive/2014-03-03-Nexus · Vendor Advisory
• http://secunia.com/advisories/57142 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-2034 · Security Note
• http://osvdb.org/104049 · Note
• http://securityfocus.com/bid/65956 · Note