Unscored severity · published Jan 17, 2014
CVE-2014-0792
Sonatype Nexus 1.x and 2.x before 2.7.1 allows remote attackers to create arbitrary objects and execute arbitrary code via unspecified vectors related to unmarshalling of…
–
CVSS
3%
EPSS
No
On KEV
Description
Sonatype Nexus 1.x and 2.x before 2.7.1 allows remote attackers to create arbitrary objects and execute arbitrary code via unspecified vectors related to unmarshalling of unintended Object types.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.0% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
Nexus · Sonatype
1.0; 2.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; +19 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-0792
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-0792
Patch
http://www.sonatype.org/advisories/archive/2014-01-13-Nexus
sonatype.zendesk.com
https://sonatype.zendesk.com/entries/37551958-Configuring-Xstream-Whitelist
Patch
https://support.sonatype.com/entries/37828023-Nexus-Security-Vulnerability
More from Nexus
8.8
CVE-2020-10199
Sonatype Nexus Repository Remote Code Execution Vulnerability
8.8
CVE-2020-11444
Sonatype Nexus Repository Manager 3.x up to and including 3.21.2 has Incorrect Access Control
7.2
CVE-2020-10204
Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution
4.9
CVE-2020-24622
In Sonatype Nexus Repository 3.26.1, an S3 secret key can be exposed by an admin user
4.8
CVE-2020-10203
Sonatype Nexus Repository before 3.21.2 allows XSS