Nexus Repository 3 signing key and access control flaws
Package storage software can let attackers take accounts or steal data!
Summary
Several flaws in Nexus Repository 3 expose a repository signing key and passphrase to read-only accounts, and let low-privilege users log in as others or change data. Versions before 3.98.0 are affected.
Affected when
- Some flaws apply only when the non-default setting nexus.reindex.search.by.pattern.visible is set to true
What to do
Update to 3.98.0 or newer.
Products and platforms
CVE IDs
Sources
- Advisory: support.sonatype.com (opens in a new tab) · support.sonatype.com (opens in a new tab) · support.sonatype.com (opens in a new tab) · support.sonatype.com (opens in a new tab) · support.sonatype.com (opens in a new tab) · support.sonatype.com (opens in a new tab) · support.sonatype.com (opens in a new tab)
Times
First published
First seen