PT-2020-12601 · Sonatype · Sonatype Nexus Repository Manager+1

Published 2020-04-27 · Updated 2020-05-01 · CVE-2020-11415

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Sonatype Nexus Repository Manager versions 2.x through 2.14.17 Sonatype Nexus Repository Manager versions 3.x through 3.22.1

Description An issue was discovered where admin users can retrieve the LDAP server system username/password in cleartext.

Recommendations For Sonatype Nexus Repository Manager versions 2.x through 2.14.17, update to version 2.14.17 or later. For Sonatype Nexus Repository Manager versions 3.x through 3.22.1, update to version 3.22.1 or later.

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2020-11415

Affected Products

Nexus Repository Manager

Sonatype Nexus Repository Manager

References · 4

• https://support.sonatype.com/hc/en-us/articles/360045360854 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-11415 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11415 · Security Note
• https://t.me/cvenotify/3238 · Telegram Post