PT-2019-6311 · Sonatype · Nexus Repository Manager

Badcode · Published 2019-11-01 · Updated 2019-11-06 · CVE-2019-15588

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Nexus Repository Manager versions <= 2.14.14

Description The issue is related to an OS Command Injection that could allow an attacker to achieve Remote Code Execution (RCE). This is due to the lack of input data sanitization. All instances using CommandLineExecutor.java with user-supplied data are affected, such as the Yum Configuration Capability. The exploitation of this issue may enable a remote attacker to execute arbitrary code.

Recommendations For Nexus Repository Manager versions <= 2.14.14, consider restricting the use of CommandLineExecutor.java with user-supplied data until a fix is available. As a temporary workaround, avoid using the Yum Configuration Capability with untrusted input to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

BDU:2023-00715

CVE-2019-15588

Affected Products

Nexus Repository Manager

References · 6

• https://osv.dev/vulnerability/CVE-2019-15588 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-15588 · Security Note
• https://support.sonatype.com/hc/en-us/articles/360033490774-CVE-2019-5475-Nexus-Repository-Manager-2-OS-Command-Injection-2019-08-09 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00715 · Security Note
• https://hackerone.com/reports/688270 · Patch
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15588 · Note