CVE-2021-40143CWE-74

CVE-2021-40143

High · published September 8, 2021

CVSS v3.1
8.2
EPSS
2%
Percentile
83.3
In the wild
Unconfirmed
What it is

Sonatype Nexus Repository 3.x through 3.33.1-01 is vulnerable to an HTTP header injection. By sending a crafted HTTP request, a remote attacker may disclose sensitive information or request external resources from a vulnerable instance.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.02322 · 83.3th percentile
Weakness
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Published
2021-09-08T00:15Z
Affected products (1)
ProductVersionsFixed in
sonatype/nexus_repository_manager≥ 3.0.0, < 3.34.1-013.34.1-01
References (4)
https://issues.sonatype.org/secure/ReleaseNote.jspa · [email protected]https://support.sonatype.com/hc/en-us/articles/4405941762579 · [email protected]https://issues.sonatype.org/secure/ReleaseNote.jspa · af854a3a-2127-422b-91ae-364da2661108https://support.sonatype.com/hc/en-us/articles/4405941762579 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 07 SEP 19:28Z
    Sonatype Nexus Repository 3.x through 3.33.1-01 is vulnerable to an HTTP header injection
    cvelistv5