PT-2019-17696 · Sonatype · Nexus Yum Repository Plugin+1

Published 2019-09-03 · Updated 2019-11-01 · CVE-2019-5475

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Nexus Yum Repository Plugin version v2

Description The issue allows for Remote Code Execution when instances using CommandLineExecutor.java are supplied vulnerable data, such as the Yum Configuration Capability.

Recommendations For Nexus Yum Repository Plugin version v2, consider restricting the use of CommandLineExecutor.java until a patch is available to prevent Remote Code Execution. Avoid supplying vulnerable data, such as the Yum Configuration Capability, to minimize the risk of exploitation.

Exploit

Fix

RCE

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

BDU:2023-00715

CVE-2019-5475

GHSA-G5M7-57PH-J6P8

Affected Products

Nexus Repository Manager

Nexus Yum Repository Plugin

References · 12

• 🔥 https://github.com/rabbitmask/CVE-2019-5475-EXP · Exploit
• 🔥 https://github.com/jaychouzzk/CVE-2019-5475-Nexus-Repository-Manager- · Exploit
• 🔥 https://github.com/lyy289065406/CVE-2019-5475 · Exploit
• 🔥 https://github.com/EXP-Docs/CVE-2019-5475 · Exploit
• 🔥 https://hackerone.com/reports/654888 · Exploit
• https://osv.dev/vulnerability/GHSA-g5m7-57ph-j6p8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-5475 · Security Note
• https://osv.dev/vulnerability/CVE-2019-5475 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00715 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-15588 · Security Note
• https://support.sonatype.com/hc/en-us/articles/360033490774-CVE-2019-5475-Nexus-Repository-Manager-2-OS-Command-Injection-2019-08-09 · Note
• https://hackerone.com/reports/688270 · Note