CVE-2019-15588
HIGH 7.2EPSS 5.6%
There is an OS Command Injection in Nexus Repository Manager <= 2.14.14 (bypass CVE-2019-5475) that could allow an attacker a Remote Code Execution (RCE). All instances using CommandLineExecutor.java with user-supplied data is vulnerable, such as the Yum Configuration Capability.
- Affected
- Nexus Repository Manager
- CVSS v3.1 NVD
- 7.2 HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - CVSS v2.0 NVD
- 9.0 HIGH
AV:N/AC:L/Au:S/C:C/I:C/A:C - EPSS
- 5.60% chance of exploitation in the next 30 days, 93rd percentile
- Published
- 2019-11-01
- Updated
- 2024-08-05
Proof-of-concept exploits (4)
- EXP-Docs/CVE-2019-155880★ · 2023-01-24
- EXP-Docs/CVE-2019-54755★ · 2023-01-24
- lyy289065406/CVE-2019-155880★ · 2023-01-24
- lyy289065406/CVE-2019-54755★ · 2023-01-24
Security advisories
- https://support.sonatype.com/hc/en-us/articles/360033490774-CVE-2019-5475-Nexus-Repositor…
- https://hackerone.com/reports/688270