CVE-2024-5764CWE-798

Nexus Repository 3 - Static hard-coded encryption passphrase used by default

Medium · published October 23, 2024

CVSS v4.0
5.9
EPSS
0%
Percentile
32.1
In the wild
Unconfirmed
What it is

Use of Hard-coded Credentials vulnerability in Sonatype Nexus Repository has been discovered in the code responsible for encrypting any secrets stored in the Nexus Repository configuration database (SMTP or HTTP proxy credentials, user tokens, tokens, among others). The affected versions relied on a static hard-coded encryption passphrase. While it was possible for an administrator to define an alternate encryption passphrase, it could only be done at first boot and not updated.

This issue affects Nexus Repository: from 3.0.0 through 3.72.0.

The record
Technical detail
CVSS v4.0
5.9 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00392 · 32.1th percentile
Weakness
CWE-798 · Use of Hard-coded Credentials
Published
2024-10-23T14:47Z
EPSS history
Timeline
  • 23 OCT 14:47Z
    Nexus Repository 3 - Static hard-coded encryption passphrase used by default
    cvelistv5