PT-2020-15773 · Sonatype · Sonatype Nexus Repository+1

Published 2020-08-25 · Updated 2022-04-28 · CVE-2020-24622

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Sonatype Nexus Repository version 3.26.1

Description The issue allows an admin user to expose an S3 secret key.

Recommendations For Sonatype Nexus Repository version 3.26.1, update to a version that contains a fix for this issue to prevent exposure of the S3 secret key.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2020-24622

Affected Products

Nexus Repository Manager

Sonatype Nexus Repository

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-24622 · Security Note
• https://support.sonatype.com/hc/en-us/articles/360053516793 · Vendor Advisory
• https://issues.sonatype.org/browse/NEXUS-25019 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-24622 · Vendor Advisory