CVE-2020-10199

HighCVSS 8.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-917

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/157261/Nexus-Repository-Manager-3.21.1-01-Remote-Code-Execution.htmlPatch, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/160835/Sonatype-Nexus-3.21.1-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
https://cwe.mitre.org/data/definitions/917.htmlThird Party Advisory
https://support.sonatype.com/hc/en-us/articles/360044882533Patch, Vendor Advisory
http://packetstormsecurity.com/files/157261/Nexus-Repository-Manager-3.21.1-01-Remote-Code-Execution.htmlPatch, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/160835/Sonatype-Nexus-3.21.1-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
https://cwe.mitre.org/data/definitions/917.htmlThird Party Advisory
https://support.sonatype.com/hc/en-us/articles/360044882533Patch, Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-10199US Government Resource

Timeline

Published: Apr 1, 2020
Last modified: Jun 17, 2026
Added to CISA KEV: Nov 3, 2021
NVD status: Analyzed

Related CVEs from 2020

CVE-2020-10208.8A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially CVE-2020-102034.8Sonatype Nexus Repository before 3.21.2 allows XSS.CVE-2020-102047.2Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution.CVE-2020-102064.4Use of a Hard-coded Password in VNCserver in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6xx series, Aria7/AK7Xx seri CVE-2020-102079.8Use of Hard-coded Credentials in EntoneWebEngine in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6xx series, Aria7/AK7 CVE-2020-102089.9Command Injection in EntoneWebEngine in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6xx series, Aria7/AK7Xx series an CVE-2020-102098.1Command Injection in the CPE WAN Management Protocol (CWMP) registration in Amino Communications AK45x series, AK5xx series, AK65x series, A CVE-2020-10217.8An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files. The vulnerability could CVE-2020-102109.8Because of hard-coded SSH keys for the root user in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6xx series, Aria7/AK7 CVE-2020-102119.8A remote code execution vulnerability in UCB component of Mitel MiVoice Connect before 19.1 SP1 could allow an unauthenticated remote attack CVE-2020-102129.8upload.php in Responsive FileManager 9.13.4 and 9.14.0 allows SSRF via the url parameter because file-extension blocking is mishandled and b CVE-2020-102138.8An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the wps_sta_enro