GitHub Advisoryadvisory · Maven

GHSA-g5m7-57ph-j6p8 OS Command Injection in Nexus Yum Repository Plugin

HIGH Published 2019-09-11 Modified 2021-08-17 Official page ↗
Aliases
CVE-2019-5475
Ecosystem
Maven
Packages
org.sonatype.nexus.plugins:nexus-yum-repository-plugin
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78
Reviewed
2019-09-04

Affected packages

• Maven org.sonatype.nexus.plugins:nexus-yum-repository-plugin: < 2.14.14 → fixed in 2.14.14

Description

The Nexus Yum Repository Plugin in v2 is vulnerable to Remote Code Execution when instances using CommandLineExecutor.java are supplied vulnerable data, such as the Yum Configuration Capability.

Related

Alias · CVE (1)

  • CVE-2019-5475 The Nexus Yum Repository Plugin in v2 is vulnerable to Remote Code Execution when instances using CommandLineExecutor.java are supplied… vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References