CVE-2019-5475

The Nexus Yum Repository Plugin in v2 is vulnerable to Remote Code Execution when instances using CommandLineExecutor.java are supplied vulnerable data, such as the Yum Configuration Capability.

Affected

Nexus Repository Manager

CVSS v3.0 NVD

8.8 HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

9.0 HIGHAV:N/AC:L/Au:S/C:C/I:C/A:C

EPSS

18.40% chance of exploitation in the next 30 days, 97th percentile

Published

2019-09-03

Updated

2024-08-04

Proof-of-concept exploits (5)

• https://hackerone.com/reports/654888
• EXP-Docs/CVE-2019-54755★ · 2023-01-24
• jaychouzzk/CVE-2019-5475-Nexus-Repository-Manager-7★ · 2019-09-25
• lyy289065406/CVE-2019-54755★ · 2023-01-24
• rabbitmask/CVE-2019-5475-EXP4★ · 2020-04-12

Security advisories

• advisories/GHSA-g5m7-57ph-j6p8

References

• CVE Record
• NVD entry

Related

• CVE-2019-15588
• CVE-2020-13277
• CVE-2020-13933
• CVE-2021-22192
• CVE-2019-0193
• CVE-2019-1388