Intrusion PreventionNexus.Repository.Manager.Expression.Language.Injection
Description
This indicates an attack attempt to exploit an Expression Language Injection Vulnerability in Sonatype Nexus Repository.
This vulnerability is due to insufficient handling of HTTP request. Successful exploitation results in the execution of arbitrary code on the target system with privileges of SYSTEM user.
Affected Products
All previous Nexus Repository Manager 3.x OSS/Pro versions up to and including 3.21.1
Impact
System Compromise: Remote attackers can gain control of vulnerable systems.
Recommended Actions
Apply the most recent upgrade or patch from the vendor.
https://support.sonatype.com/hc/en-us/articles/360044882533
Telemetry
Coverage
| IPS (Regular DB) | |
| IPS (Extended DB) |
Version Updates
| Date | Version | Detail |
|---|---|---|
| 2020-09-03 | 16.917 | Sig Added |
| 2020-07-22 | 15.892 | Default_action:pass:drop |
| 2020-06-22 | 15.869 | Sig Added |
| 2020-05-11 | 15.841 | Sig Added |
| 2020-05-06 | 15.838 | |
| 2020-05-06 | 15.837 | |
| 2020-05-06 | 15.836 |
| ID | 48896 |
| Created | May 06, 2020 |
| Updated | Dec 08, 2022 |
| Risk |
|
| CVE ID | CVE-2020-10199 |
| Known Exploited | Yes |
| Exploit Prediction Score | 97.28% |
| Default Action | drop |
| Active | |
| Affected OS | Windows, Linux, MacOS |
| Affected App | Other |