Nexus Repository Manager 3 - Remote Code Execution

ALTO 8.8EXPLOITED (CISA KEV)CVE-2020-10199 · GHSA-g2f6-v5qh-h2mq · Published 01/04/2020 · updated 17/06/2026

Sonatype Nexus Repository Remote Code Execution Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 03/11/2021. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
org.sonatype.nexus:nexus-extdirect Maven	`< 3.21.2`	`3.21.2`
nexus sonatype	`< 3.21.2`	`3.21.2`

Description

Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).

NVD description

Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).

References

nvd.nist.gov/vuln/detail/CVE-2020-10199 · ADVISORY
cwe.mitre.org/data/definitions/917.html · WEB
sonatype/nexus-public · PACKAGE
securitylab.github.com/advisories/GHSL-2020-015-nxrm-sonatype · ADVISORY
support.sonatype.com/hc/en-us/articles/360044882533 · WEB
cisa.gov/known-exploited-vulnerabilities-catalog · WEB
packetstormsecurity.com/files/157261/Nexus-Repository-Manager-3.21.1-01-Remote-Code-Execution.html · WEB
packetstormsecurity.com/files/160835/Sonatype-Nexus-3.21.1-Remote-Code-Execution.html · WEB
CISA KEV · CVE-2020-10199

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free