CVE-2014-0792

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Sonatype Nexus 1.x and 2.x before 2.7.1 allows remote attackers to create arbitrary objects and execute arbitrary code via unspecified vectors related to unmarshalling of unintended Object types.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.sonatype.org/advisories/archive/2014-01-13-NexusPatch, Vendor Advisory
https://sonatype.zendesk.com/entries/37551958-Configuring-Xstream-Whitelist
https://support.sonatype.com/entries/37828023-Nexus-Security-VulnerabilityPatch, Vendor Advisory
http://www.sonatype.org/advisories/archive/2014-01-13-NexusPatch, Vendor Advisory
https://sonatype.zendesk.com/entries/37551958-Configuring-Xstream-Whitelist
https://support.sonatype.com/entries/37828023-Nexus-Security-VulnerabilityPatch, Vendor Advisory

Timeline

Published: Jan 17, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-07934.3Multiple cross-site scripting (XSS) vulnerabilities in the StackIdeas Komento (com_komento) component before 1.7.3 for Joomla! allow remote CVE-2014-07944.3SQL injection vulnerability in the JV Comment (com_jvcomment) component before 3.0.3 for Joomla! allows remote authenticated users to execut CVE-2014-08025.8Directory traversal vulnerability in the aokitaka ZIP with Pass application 4.5.7 and earlier, and ZIP with Pass Pro application 6.3.8 and e CVE-2014-08035.8Directory traversal vulnerability in the tetra filer application 2.3.1 and earlier for Android 4.0.3, tetra filer free application 2.3.1 and CVE-2014-08045.8Directory traversal vulnerability in the CGENE Security File Manager Pro application 1.0.6 and earlier, and Security File Manager Trial appl CVE-2014-08055.8Directory traversal vulnerability in the NeoFiler application 5.4.3 and earlier, NeoFiler Free application 5.4.3 and earlier, and NeoFiler L CVE-2014-08064.3The Sleipnir Mobile application 2.12.1 and earlier and Sleipnir Mobile Black Edition application 2.12.1 and earlier for Android provide Geol CVE-2014-08076.4data/class/pages/shopping/LC_Page_Shopping_Deliv.php in LOCKON EC-CUBE 2.4.4 and earlier, and 2.11.0 through 2.12.2, allows remote attackers CVE-2014-08089.1Authorization bypass through user-controlled key issue exists in EC-CUBE 2.11.0 through 2.12.2 and EC-Orange systems deployed before June 29 CVE-2014-08094.3Directory traversal vulnerability in the Gapless Player SimZip (aka Simple Zip Viewer) application before 1.2.1 for Android allows remote at CVE-2014-08107.5Unspecified vulnerability in JustSystems Sanshiro 2007 before update 3, 2008 before update 5, 2009 before update 6, and 2010 before update 6 CVE-2014-08114.3Cross-site scripting (XSS) vulnerability in Blackboard Vista/CE 8.0 SP6 and earlier allows remote attackers to inject arbitrary web script o