CVE-2019-5475 - The Nexus Yum Repository Plugin in v2 is vulnerable to Remote Code Execution when instances using CommandLineExecutor.java are supplied vulnerable data, such as the Yum Configuration Capability

Back Back to CVE browser

HIGH

The Nexus Yum Repository Plugin in v2 is vulnerable to Remote Code Execution when instances using CommandLineExecutor.java are supplied vulnerable data, such as the Yum Configuration Capability

Published Sep 3, 2019

8.8

HIGH

CVSS 3.0

EPSS 18.40%

Description

The Nexus Yum Repository Plugin in v2 is vulnerable to Remote Code Execution when instances using CommandLineExecutor.java are supplied vulnerable data, such as the Yum Configuration Capability.

Affected products

Vendor n/a Product Nexus Repository Manager Default
n/a
- Version
  2.14.9-01
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Nexus Repository Manager

n/a

Version	Status	Constraints
2.14.9-01	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-0667
Advisory
https://github.com/advisories/GHSA-g5m7-57ph-j6p8
Advisory
https://hackerone.com/reports/654888
x_refsource_MISCExploitThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-5475

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-0667		Advisory
https://github.com/advisories/GHSA-g5m7-57ph-j6p8		Advisory
https://hackerone.com/reports/654888		x_refsource_MISCExploitThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-5475