GitHub Advisoryadvisory · Maven

GHSA-f34x-8pf6-qc9c HTTP header injection in Sonatype Nexus Repository

HIGH Published 2021-09-08 Modified 2021-09-15 Official page ↗
Aliases
CVE-2021-40143
Ecosystem
Maven
Packages
org.sonatype.nexus:nexus-repository
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Weaknesses
CWE-74
Reviewed
2021-09-08

Affected packages

• Maven org.sonatype.nexus:nexus-repository: >= 3.0.0, < 3.34.0-01 → fixed in 3.34.0-01

Description

Sonatype Nexus Repository 3.x through 3.33.1-01 is vulnerable to an HTTP header injection. By sending a crafted HTTP request, a remote attacker may disclose sensitive information or request external resources from a vulnerable instance.

Related

Alias · CVE (1)

  • CVE-2021-40143 Sonatype Nexus Repository 3.x through 3.33.1-01 is vulnerable to an HTTP header injection. vulnerability

Weakness · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References