PT-2024-37131 · Sonatype · Sonatype Nexus Repository+1

Published 2024-10-23 · Updated 2025-11-06 · CVE-2024-5764

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Sonatype Nexus Repository versions 3.0.0 through 3.72.0

Description: A Use of Hard-coded Credentials vulnerability has been discovered in the code responsible for encrypting secrets stored in the Nexus Repository configuration database, such as SMTP or HTTP proxy credentials and user tokens. The affected versions relied on a static hard-coded encryption passphrase, which could only be altered at first boot and not updated.

Recommendations: For Sonatype Nexus Repository versions 3.0.0 through 3.72.0, update the encryption passphrase as soon as possible to prevent exploitation. As a temporary workaround, consider restricting access to sensitive areas of the Nexus Repository configuration database until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2024-5764

Affected Products

Nexus Repository Manager

Sonatype Nexus Repository

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-5764 · Security Note
• https://support.sonatype.com/hc/en-us/articles/34496708991507 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-5764 · Vendor Advisory
• https://t.me/cvedetector/8696 · Telegram Post
• https://twitter.com/fin3ss3g0d/status/1898102130906451977 · Twitter Post
• https://t.me/cveNotify/141956 · Telegram Post
• https://t.me/cvenotify/100832 · Telegram Post
• https://twitter.com/MaverisLabs/status/1872652111076552821 · Twitter Post
• https://twitter.com/fin3ss3g0d/status/1872675093371031682 · Twitter Post