Cross-Site Scripting Vulnerability in Nexus Repository Manager by Sonatype
CVE-2021-29159

6.1MEDIUM

Key Information:

Vendor

Sonatype

Status
Nexus Repository Manager
Vendor
CVE Published:
28 April 2021

What is CVE-2021-29159?

A cross-site scripting (XSS) vulnerability exists in Nexus Repository Manager 3.x versions before 3.30.1. This vulnerability allows attackers with local accounts to manipulate entities by crafting properties that execute arbitrary JavaScript when viewed by an administrator. Such attacks can compromise the security of web applications and expose sensitive information within the NXRM context.

References

https://support.sonatype.com/hc/en-us/categories/20198076...
x_refsource_MISC
https://support.sonatype.com/hc/en-us/articles/1500005031082
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.