OS Command Injection in Nexus Yum Repository Plugin

HIGH 8.8CVE-2019-5475 · GHSA-g5m7-57ph-j6p8 · Published 03/09/2019 · updated 17/06/2026

Package	Affected versions	Patched versions
org.sonatype.nexus.plugins:nexus-yum-repository-plugin Maven	`< 2.14.14`	`2.14.14`
nexus repository manager sonatype	`≥ 2.0, ≤ 2.14.9-01`	No fix yet

Description

The Nexus Yum Repository Plugin in v2 is vulnerable to Remote Code Execution when instances using CommandLineExecutor.java are supplied vulnerable data, such as the Yum Configuration Capability.

NVD description

The Nexus Yum Repository Plugin in v2 is vulnerable to Remote Code Execution when instances using CommandLineExecutor.java are supplied vulnerable data, such as the Yum Configuration Capability.

References

nvd.nist.gov/vuln/detail/CVE-2019-5475 · ADVISORY
hackerone.com/reports/654888 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free