| Package | Affected versions | Patched versions |
|---|---|---|
| nexus repository manager | ≥ 3.16.0, < 3.95.0 | 3.95.0 |
Nexus Repository 3 was found to be vulnerable to stored cross-site scripting (XSS). A user with the nexus:blobstores:create or nexus:blobstores:update permission could set a blob store name containing malicious script content, which would later execute in the browser of another user viewing system health-check status. This issue has been fixed in version 3.95.0.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free