CVE-2019-15588

State: Published
Severity: Not scored
Published: Nov 1, 2019
Updated: Aug 5, 2024
Reserved: Aug 26, 2019

Description

There is an OS Command Injection in Nexus Repository Manager <= 2.14.14 (bypass CVE-2019-5475) that could allow an attacker a Remote Code Execution (RCE). All instances using CommandLineExecutor.java with user-supplied data is vulnerable, such as the Yum Configuration Capability.

Scores

The record has no CVSS score.

Weaknesses

CWE-77 Command Injection - Generic (CWE-77)

Affected Products

Product	Versions
Nexus Repository Managern/a	<= 2.14.14Affected

References

https://hackerone.com/reports/688270
https://support.sonatype.com/hc/en-us/articles/360033490774-CVE-2019-5475-Nexus-Repository-Manager-2-OS-Command-Injection-2019-08-09

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.