PT-2024-9211 · Sonatype · Sonatype Nexus Repository+1

Published 2024-05-17 · Updated 2024-11-19 · CVE-2024-5082

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions: Sonatype Nexus Repository 2 versions up to and including 2.15.1

Description: A Remote Code Execution issue has been discovered, related to incorrect code generation management. This allows a remote attacker to execute arbitrary code by publishing Maven artifacts, potentially leading to system compromise.

Recommendations: For versions up to and including 2.15.1, update to a version later than 2.15.1 to resolve the issue. As a temporary workaround, consider restricting access to the Maven artifact publication feature until a patch is available.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2024-10899

CVE-2024-5082

Affected Products

Nexus Repository Manager

Sonatype Nexus Repository

References · 17

• https://support.sonatype.com/hc/en-us/articles/30694125380755 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-5082 · Security Note
• https://bdu.fstec.ru/vul/2024-10899 · Security Note
• https://twitter.com/the_yellow_fall/status/1858331973959479539 · Twitter Post
• https://help.sonatype.com/ru/download-nexus-2.html · Note
• https://twitter.com/fletch_ai/status/1858752202812371259 · Twitter Post
• https://twitter.com/fletch_ai/status/1858963679720730827 · Twitter Post
• https://t.me/latest_high_impact_cve/1512 · Telegram Post
• https://support.sonatype.com/hc/en-us/articles/30694125380755-CVE-2024-5082-Nexus-Repository-2-Remote-Code-Execution · Note
• https://twitter.com/fridaysecurity/status/1858333253972721673 · Twitter Post
• https://t.me/pentestingnews/53328 · Telegram Post
• https://t.me/cvedetector/10904 · Telegram Post
• https://vuldb.com/?id.284512 · Note
• https://cybersecuritynews.com/sonatype-nexus-repository-manager · Note
• https://twitter.com/CVEnew/status/1857065033764667596 · Twitter Post