GCVE - cpe:2.3:a:sonatype:nexus:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:sonatype:nexus:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Sonatype (`4f13373e-a28c-5625-a507-2b5658f30fd0`)
Product	Nexus (`1225ce61-3ac4-551b-b93d-c997bce99d08`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:docker/sonatype/nexus`	purl2cpe	2026-06-01 10:16:48.996386
`pkg:github/sonatype/nexus-public`	purl2cpe	2026-06-01 10:16:48.996388
`pkg:maven/org.sonatype.nexus/nexus`	purl2cpe	2026-06-01 10:16:48.996390

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-5764`	vulnerable	2026-06-08 06:56:17.397652	Nexus Repository 3 - Static hard-coded encryption passphrase used by default Use of Hard-coded Credentials vulnerability in Sonatype Nexus Repository has been discovered in the code responsible for encrypting any secrets stored in the Nexus Repository configuration database (SMTP or HTTP proxy credentials, user tokens, tokens, among others). The affected versions relied on a static hard-coded encryption passphrase. While it was possible for an administrator to define an alternate encryption passphrase, it could only be done at first boot and not updated. This issue affects Nexus Repository: from 3.0.0 through 3.72.0. Published: 2024-10-23T14:47:55.783Z Updated: 2024-10-23T15:55:05.124Z Open on db.gcve.eu Reference links https://support.sonatype.com/hc/en-us/articles/34496708991507	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-24622`	vulnerable	2026-06-08 05:22:35.100175	Details available In Sonatype Nexus Repository 3.26.1, an S3 secret key can be exposed by an admin user. Published: 2020-08-25T18:17:49.000Z Updated: 2024-08-04T15:19:08.569Z Open on db.gcve.eu Reference links https://issues.sonatype.org/browse/NEXUS-25019 https://support.sonatype.com/hc/en-us/articles/360053516793	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-11444`	vulnerable	2026-06-08 05:16:47.197378	Details available Sonatype Nexus Repository Manager 3.x up to and including 3.21.2 has Incorrect Access Control. Published: 2020-04-02T17:22:04.000Z Updated: 2024-08-04T11:28:13.882Z Open on db.gcve.eu Reference links https://support.sonatype.com https://support.sonatype.com/hc/en-us/articles/360046133553	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-10204`	vulnerable	2026-06-08 05:16:34.863524	Details available Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution. Published: 2020-04-01T18:21:12.000Z Updated: 2024-08-04T10:58:39.507Z Open on db.gcve.eu Reference links https://support.sonatype.com/hc/en-us/articles/360044356194	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-10203`	vulnerable	2026-06-08 05:16:34.863209	Details available Sonatype Nexus Repository before 3.21.2 allows XSS. Published: 2020-04-01T18:04:39.000Z Updated: 2024-08-04T10:58:39.549Z Open on db.gcve.eu Reference links https://support.sonatype.com/hc/en-us/articles/360044361594	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-10199`	vulnerable	2026-06-08 05:16:34.862814	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-7238`	vulnerable	2026-06-08 05:14:14.137913	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.