Sonatype · Nexus Repository
Sonatype Nexus Repository, before version 3.21.2, contains a JavaEL injection flaw, classified as improper neutralization of special elements in an expression language statement. An attacker with network access and low-privileged authentication, requiring no user interaction, could exploit this flaw to execute arbitrary code on the affected system.
Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).
First seen exploited 19 months after disclosure. Public exploit code (Metasploit) was available 1 day before disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
Network-exploitable injection in public-facing repository
allows JavaEL Injection (issue 1 of 2)
Expression injection enables arbitrary code execution
allows JavaEL Injection (issue 1 of 2)
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
1 package in 1 ecosystem. Main package: org.sonatype.nexus:nexus-extdirect.
Upgrade to 3.21.2 or later
Set the version to 3.21.2 or later in your pom.xml or build.gradle.
The first fix for CVE-2020-10199. No other CVE tracked by Patchfirst affects this package.
| If you run | Upgrade to |
|---|---|
| All versions before 3.21.2 | 3.21.2 |
“Up to” means the second version is the fix and is not affected.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.