Access Control Issue in Sonatype Nexus Repository Manager
CVE-2021-42568

4.3MEDIUM

Key Information:

Vendor

Sonatype

Status
Nexus Repository Manager
Vendor
CVE Published:
2 November 2021

What is CVE-2021-42568?

Sonatype Nexus Repository Manager versions 3.x through 3.35.0 are susceptible to an access control vulnerability that allows low-privileged accounts to access the SSL Certificates Loading function. This flaw could potentially enable unauthorized users to view or manipulate sensitive SSL certificate information, posing a risk to the integrity and confidentiality of the data managed by the repository.

References

https://support.sonatype.com
x_refsource_MISC
https://support.sonatype.com/hc/en-us/articles/4408801690...
x_refsource_MISC

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.