Unrestricted Upload of File with Dangerous Type in Sonatype Nexus Repository Manager

높음 7.2CVE-2019-16530 · GHSA-hmjv-px3j-933c · Published 21/10/2019 · updated 17/06/2026

요약

CVE-2019-16530은(는) org.sonatype.nexus:nexus-repository, nexus iq server (sonatype), nexus repository manager (sonatype)에 영향을 주는 높음 (CVSS 7.2) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 3.3%, 전체 취약점의 88.7%보다 높음.
조치: 2.14.15, 3.19.0 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
org.sonatype.nexus:nexus-repository Maven	`≥ 2.0.0, < 2.14.15≥ 3.0.0, < 3.19.0`	`2.14.153.19.0`
nexus iq server sonatype	`≤ 72`	No fix yet
nexus repository manager sonatype	`≥ 2.0.0, ≤ 2.14.14≥ 3.0.0, ≤ 3.18.1`	No fix yet

Sonatype Nexus Repository Manager 2.x before 2.14.15 and 3.x before 3.19, and IQ Server before 72, has remote code execution.

NVD description

Sonatype Nexus Repository Manager 2.x before 2.14.15 and 3.x before 3.19, and IQ Server before 72, has remote code execution.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.