PT-2021-22818 · Sonatype · Sonatype Nexus Repository+1

Published 2021-09-07 · Updated 2021-09-14 · CVE-2021-40143

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Sonatype Nexus Repository versions 3.x through 3.33.1-01

Description The issue allows a remote attacker to disclose sensitive information or request external resources from a vulnerable instance by sending a crafted HTTP request. This is due to an HTTP header injection.

Recommendations For versions 3.x through 3.33.1-01, update to a version later than 3.33.1-01 to resolve the issue.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2021-40143

GHSA-F34X-8PF6-QC9C

Affected Products

Nexus Repository Manager

Sonatype Nexus Repository

References · 7

• https://osv.dev/vulnerability/CVE-2021-40143 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-40143 · Security Note
• https://support.sonatype.com/hc/en-us/articles/4405941762579 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f34x-8pf6-qc9c · Vendor Advisory
• https://github.com/sonatype/nexus-public · Note
• https://issues.sonatype.org/secure/ReleaseNote.jspa · Note
• https://help.sonatype.com/repomanager3/release-notes/2021-release-notes · Note