CVE-2020-10204

Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution.

CVSS v3.1 NVD

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 GitHub

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

9.0 HIGHAV:N/AC:L/Au:S/C:C/I:C/A:C

EPSS

38.42% chance of exploitation in the next 30 days, 99th percentile

Nuclei

high · CWE-20

Published

2020-04-01

Updated

2024-08-04

Proof-of-concept exploits (3)

• magicming200/CVE-2020-10199_CVE-2020-1020425★ · 2020-04-12
• wsfengfan/CVE-2020-10199-1020419★ · 2020-04-07
• zhzyker/CVE-2020-1020413★ · 2020-05-27

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-10204.yaml

Vulhub environments (1)

• vulhub/vulhub/tree/master/nexus/CVE-2020-10204

Exploit collections (2)

• nexus-cve-2020-10204.ymlchaitin/xray
• CVE-2020-10204.yamlzan8in/afrog

Security advisories

• https://support.sonatype.com/hc/en-us/articles/360044356194
• advisories/GHSA-8h56-v53h-5hhj

References

• CVE Record
• NVD entry

Related

• CVE-2019-7238
• CVE-2020-10199
• CVE-2022-22965
• CVE-2019-2618
• CVE-2020-0796
• CVE-2020-14882