CVE-2019-5475

The Nexus Yum Repository Plugin in v2 is vulnerable to Remote Code Execution when instances using CommandLineExecutor.java are supplied vulnerable data, such as the Yum Configuration Capability.

Affected products

Nexus Repository Manager, Nexus Yum Repository Plugin

Sonatype Nexus Repository Manager

≤ 2.14.9-01

Fix

Available

CVSS 2.0

9.0 HIGH

CVSS 3.1

8.8 HIGH

EPSS

18.4% (97th percentile)

Weakness

CWE-78

NVD status

Modified

Published

2019-09-03