Description

There is an OS Command Injection in Nexus Repository Manager <= 2.14.14 (bypass CVE-2019-5475) that could allow an attacker a Remote Code Execution (RCE). All instances using CommandLineExecutor.java with user-supplied data is vulnerable, such as the Yum Configuration Capability.

Remediation

References

CVE-2019-15588

Related Vulnerabilities

WordPress Plugin Crayon Syntax Highlighter 'wp_load' Parameter Remote File Include (1.12.1)

WordPress Plugin Simple Fields Cross-Site Scripting (1.4.11)

MySQL Other Vulnerability (CVE-2002-1921)

Drupal Core 9.2.x Security Bypass (9.2.0 - 9.2.17)

WordPress 4.7.x Multiple Vulnerabilities (4.7 - 4.7.9)

Severity

High

Classification

CVE-2019-15588 CWE-138 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities