Sonatype Nexus Repository Task Management Component Authenticated Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in the task management component of Sonatype Nexus Repository versions 3.22.1 prior to 3.90.2. This vulnerability allows an authenticated attacker with task creation permissions to execute arbitrary code, bypassing the nexus.scripts.allowCreation security control. Successful exploitation leads to a full compromise of the Nexus server and its contents.

Impact

Exploitation of this vulnerability allows for authenticated remote code execution on the Nexus Repository server, with full compromise of the server and its contents.

Remediation

Users are advised to upgrade to Sonatype Nexus Repository version 3.91.0 or later. The latest version can be downloaded from the Sonatype Nexus Repository Downloads page.