DeutschShown in its original language — a full translation is planned for a future version.
Sonatype Nexus Repository Manager: Mehrere Schwachstellen
view advisory published 2026-10-15
Ein Angreifer kann mehrere Schwachstellen in Sonatype Nexus Repository Manager ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen, beliebigen Programmcode auszuführen oder Administratorrechte zu erlangen, sowie um einen Cross-Site Scripting Angriff durchzuführen.
01
describes (4)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-97712US | —OT elevated | — | ||
Sonatype Nexus Repository 3 allows a user that holds the role create or role update permission to grant roles and privileges that the account does not hold. This can give the user… | ||||
| CVE-2026-97667US | — | — | ||
Sonatype Nexus Repository 3 allows a user account that holds the edit permission on a hosted R repository to store script content in the metadata of an uploaded R package. The scri… | ||||
| CVE-2026-97666US | — | — | ||
Sonatype Nexus Repository 3 allows an unauthenticated remote attacker to supply attacker-controlled input to a Java class loading call through an ExtDirect endpoint. This allows th… | ||||
| CVE-2026-97665US | —OT elevated | — | ||
A missing authorization check in Nexus Repository 3's NuGet Components API upload path allows an account holding only repository read and browse privileges to upload and persist Nu… | ||||
02
references
External citations — patches, advisories, analysis.
- GitHub Security Advisory GHSA-hgx3-p778-vgjq vom 2026-10-15external
- GitHub Security Advisory GHSA-hgx3-p778-vgjq vom 2026-10-15external
- GitHub Security Advisory GHSA-g4qg-94xm-4cx6 vom 2026-10-15external
- GitHub Security Advisory GHSA-hgx3-p778-vgjq vom 2026-10-15external
- Sonatype Nexus Repository 3.97.0 Release Notes vom 2026-10-15external
- CVE-2026-97665 Nexus Repository 3 - Missing Authorization on NuGet Symbol Package Uploadexternal
- CVE-2026-97666 Nexus Repository 3 - Unsafe Reflection in ExtDirect Repository Endpointexternal
- CVE-2026-97712 Nexus Repository 3 - Privilege Escalation via Role Managementexternal
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan