CVE-2014-2034

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Unspecified vulnerability in Sonatype Nexus OSS and Pro 2.4.0 through 2.7.1 allows attackers to create arbitrary user accounts via unknown vectors related to "an unauthenticated execution path."

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/57142Vendor Advisory
http://www.osvdb.org/104049
http://www.securityfocus.com/bid/65956
http://www.sonatype.org/advisories/archive/2014-03-03-NexusVendor Advisory
https://support.sonatype.com/entries/42374566-CVE-2014-2034-Nexus-Security-Advisory-REST-APIVendor Advisory
http://secunia.com/advisories/57142Vendor Advisory
http://www.osvdb.org/104049
http://www.securityfocus.com/bid/65956
http://www.sonatype.org/advisories/archive/2014-03-03-NexusVendor Advisory
https://support.sonatype.com/entries/42374566-CVE-2014-2034-Nexus-Security-Advisory-REST-APIVendor Advisory

Timeline

Published: Apr 1, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-20354.3Cross-site scripting (XSS) vulnerability in xhr.php in InterWorx Web Control Panel (aka InterWorx Hosting Control Panel and InterWorx-CP) be CVE-2014-20375.0Openswan 2.6.40 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon restart) via IKEv2 packets tha CVE-2014-20382.1The nfs_can_extend_write function in fs/nfs/write.c in the Linux kernel before 3.13.3 relies on a write delegation to extend a write operati CVE-2014-20394.9arch/s390/kernel/head64.S in the Linux kernel before 3.13.5 on the s390 platform does not properly handle attempted use of the linkage stack CVE-2014-20402.1Multiple cross-site scripting (XSS) vulnerabilities in the (1) callback_multicheck, (2) callback_radio, and (3) callback_wysiwygin functions CVE-2014-20427.5Unrestricted file upload vulnerability in the Manage Project functionality in Livetecs Timelive before 6.5.1 allows remote authenticated use CVE-2014-20436.5SQL injection vulnerability in Resources/System/Templates/Data.aspx in Procentia IntelliPen before 1.1.18.1658 allows remote authenticated u CVE-2014-20447.5Incomplete blacklist vulnerability in ajax/upload.php in ownCloud before 5.0, when running on Windows, allows remote authenticated users to CVE-2014-20456.1Multiple cross-site scripting (XSS) vulnerabilities in the old and new interfaces in Viprinet Multichannel VPN Router 300 allow remote attac CVE-2014-20469.7cgi-bin/rpcBridge in the web interface 1.1 on Broadcom Ltd PIPA C211 rev2 does not properly restrict access, which allows remote attackers t CVE-2014-20476.8Session fixation vulnerability in ownCloud before 6.0.2, when PHP is configured to accept session parameters through a GET request, allows r CVE-2014-20489.8The user_openid app in ownCloud Server before 5.0.15 allows remote attackers to obtain access by leveraging an insecure OpenID implementatio