Attacker Value
Moderate
(1 user assessed)
Exploitability
Very Low
(1 user assessed)
User Interaction
None
Privileges Required
Low
Attack Vector
Network
0

CVE-2020-10204

Disclosure Date: April 01, 2020
Add any MITRE ATT&CK Tactics to the list below that apply to this CVE.

Description

Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution.

Add Assessment

1
Ratings
  • Attacker Value
    Medium
  • Exploitability
    Very Low
Technical Analysis

Wording on this and eludes to an authenticated RCE, but they consider an anonymous user authenticated. Nexus servers store artifacts that could be altered to pivot elsewhere. This will be a high when POC surfaces, for now I’m going lower. The number of much older versions (that also have vulnerabilities) in shodan suggests many organizations are not keeping up with patching.

General Information

Additional Info

Technical Analysis