Attacker Value
Moderate
(1 user assessed)
Exploitability
Very Low
(1 user assessed)
User Interaction
None
Privileges Required
Low
Attack Vector
Network
0

CVE-2020-10204

Disclosure Date: April 01, 2020
Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution.

Add Assessment

1
Ratings
  • Attacker Value
    Medium
  • Exploitability
    Very Low
Technical Analysis

Wording on this and eludes to an authenticated RCE, but they consider an anonymous user authenticated. Nexus servers store artifacts that could be altered to pivot elsewhere. This will be a high when POC surfaces, for now I’m going lower. The number of much older versions (that also have vulnerabilities) in shodan suggests many organizations are not keeping up with patching.

CVSS V3 Severity and Metrics
Base Score:
8.8 High
Impact Score:
5.9
Exploitability Score:
2.8
Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
Low
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
High

General Information

Vendors

  • sonatype

Products

  • nexus

Additional Info

Technical Analysis