CVE-2020-10199

sonatype nexus

Published 1 Apr 2020 · updated 17 Jun 2026 · Analyzed

8.8 High · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 3 Nov 2021, with a remediation deadline of 3 May 2022 for US federal agencies.

Required action: Apply updates per vendor instructions.

Description

Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).

References

packetstormsecurity.com/files/157261/Nexus-Repository-Manager-3.21.1-01-Remote-Code-Execution.html · Patch, Third Party Advisory, VDB Entry
packetstormsecurity.com/files/160835/Sonatype-Nexus-3.21.1-Remote-Code-Execution.html · Exploit, Third Party Advisory, VDB Entry
cwe.mitre.org/data/definitions/917.html · Third Party Advisory
support.sonatype.com/hc/en-us/articles/360044882533 · Patch, Vendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-10199 · US Government Resource