Cross-Site Scripting Vulnerability in Sonatype Nexus Repository Manager
CVE-2020-15870

6.1MEDIUM

Key Information:

Vendor

Sonatype

Status
Nexus Repository Manager 3
Vendor
CVE Published:
31 July 2020

What is CVE-2020-15870?

The XSS vulnerability in Sonatype Nexus Repository Manager OSS/Pro affects versions prior to 3.25.1, allowing attackers to inject malicious scripts into web pages viewed by other users. This can compromise the integrity of user sessions and expose sensitive data, making it critical for users to upgrade to the latest version to mitigate these risks. For more information and remediation steps, refer to Sonatype's support articles.

References

https://support.sonatype.com
x_refsource_MISC
https://support.sonatype.com/hc/en-us/articles/360051424754
x_refsource_CONFIRM

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.