CVE-2020-24622

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

In Sonatype Nexus Repository 3.26.1, an S3 secret key can be exposed by an admin user.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-522

Affected software

No affected versions have been published.

Timeline

Published
Aug 25, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-246236.5A potential security vulnerability has been identified in Hewlett Packard Enterprise Universal API Framework. The vulnerability could be remCVE-2020-246247.5Unathenticated directory traversal in the DownloadServlet class execute() method can lead to arbitrary file reads in HPE Pay Per Use (PPU) UCVE-2020-246257.5Unathenticated directory traversal in the ReceiverServlet class doGet() method can lead to arbitrary file reads in HPE Pay Per Use (PPU) UtiCVE-2020-246269.8Unathenticated directory traversal in the ReceiverServlet class doPost() method can lead to arbitrary remote code execution in HPE Pay Per UCVE-2020-246275.4A remote stored xss vulnerability was discovered in HPE KVM IP Console Switches version(s): G2 4x1Ex32 Prior to 2.8.3.CVE-2020-246288.8A remote code injection vulnerability was discovered in HPE KVM IP Console Switches version(s): G2 4x1Ex32 Prior to 2.8.3.CVE-2020-246299.8A remote urlaccesscontroller authentication bypass vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): PriorCVE-2020-246308.8A remote operatoronlinelist_content privilege escalation vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s):CVE-2020-246317.2A remote execution of arbitrary commands vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.CVE-2020-246327.2A remote execution of arbitrary commandss vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.CVE-2020-246339.8There are multiple buffer overflow vulnerabilities that could lead to unauthenticated remote code execution by sending especially crafted paCVE-2020-246349.8An attacker is able to remotely inject arbitrary commands by sending especially crafted packets destined to the PAPI (Aruba Networks AP Mana
CVE-2020-24622: Medium severity, CVSS 4.9 | Vulnix