CVE-2021-40143

HighCVSS 8.2/10Last modified Sep 22, 2026

Description

Sonatype Nexus Repository 3.x through 3.33.1-01 is vulnerable to an HTTP header injection. By sending a crafted HTTP request, a remote attacker may disclose sensitive information or request external resources from a vulnerable instance.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-74

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://issues.sonatype.org/secure/ReleaseNote.jspaNot Applicable
https://support.sonatype.com/hc/en-us/articles/4405941762579Patch, Vendor Advisory
https://issues.sonatype.org/secure/ReleaseNote.jspaNot Applicable
https://support.sonatype.com/hc/en-us/articles/4405941762579Patch, Vendor Advisory

Timeline

Published: Sep 7, 2021
Last modified: Sep 22, 2026
NVD status: Analyzed

Related CVEs from 2021

CVE-2021-401457.5gdImageGd2Ptr in gd_gd2.c in the GD Graphics Library (aka LibGD) through 2.3.2 has a double free. NOTE: the vendor's position is "The GD2 im CVE-2021-401469.8A Remote Code Execution (RCE) vulnerability was discovered in the Any23 YAMLExtractor.java file and is known to affect Any23 versions < 2.5.CVE-2021-401479.8EmTec ZOC before 8.02.2 allows \e[201~ pastes, a different vulnerability than CVE-2021-32198.CVE-2021-401487.5In Modem EMM, there is a possible information disclosure due to a missing data encryption. This could lead to remote information disclosure CVE-2021-401495.9The web server of the E1 Zoom camera through 3.0.0.716 discloses its SSL private key via the root web server directory. In this way an attac CVE-2021-40154.3firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2021-401507.5The web server of the E1 Zoom camera through 3.0.0.716 discloses its configuration via the /conf/ directory that is mapped to a publicly acc CVE-2021-401538.1squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create CVE-2021-401545.5NXP LPC55S69 devices before A3 have a buffer over-read via a crafted wlength value in a GET Descriptor Configuration request during use of U CVE-2021-401557.8A maliciously crafted DWG file in Autodesk Navisworks 2019, 2020, 2021, 2022 can be forced to read beyond allocated boundaries when parsing CVE-2021-401567.8A maliciously crafted DWG file in Autodesk Navisworks 2019, 2020, 2021, 2022 can be forced to write beyond allocated boundaries when parsing CVE-2021-401577.8A user may be tricked into opening a malicious FBX file which may exploit an Untrusted Pointer Dereference vulnerability in FBX’s Review ver