Permissions, Privileges, and Access Controls in Nexus Repository Manager - CVE-2019-9630
Published: July 26, 2019
Vulnerability identifier: #VU19395
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2019-9630
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Sonatype Inc.
Affected software:
Nexus Repository Manager
Nexus Repository Manager
Detailed vulnerability description
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to software uses weak security policy by default that allows all unauthenticated users to read files and images on the repository. A remote non-authenticated attacker can gain access to sensitive information.
How to mitigate CVE-2019-9630
Install updates from vendor's website.