Multiple Cross-Site Scripting Vulnerabilities in Sonatype Nexus Repository Manager
CVE-2021-37152

5.4MEDIUM

Key Information:

Vendor

Sonatype

Status
Nexus Repository Manager
Vendor
CVE Published:
10 August 2021

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2021-37152?

Sonatype Nexus Repository Manager 3 prior to version 3.33.0 is vulnerable to multiple Cross-Site Scripting (XSS) attacks. An authenticated attacker who can upload HTML files may exploit these vulnerabilities to manipulate user sessions by injecting malicious code. This could allow them to redirect users to compromised pages within the Nexus environment, potentially leading to unauthorized access or data theft.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2021-37152
Created by SecurityAnalysts

References

https://support.sonatype.com
x_refsource_MISC
https://support.sonatype.com/hc/en-us/articles/4404115639827
x_refsource_MISC

EPSS Score

6% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.