sonatype/nexus-public · Security
HTTP header injection in Sonatype Nexus Repository
- GHSA ID
- GHSA-f34x-8pf6-qc9c
- CVE ID
- CVE-2021-40143
- Severity
- high
- Published
- Updated
- CVSS
- 8.2 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
- CVSS v3
- 8.2 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Description
Sonatype Nexus Repository 3.x through 3.33.1-01 is vulnerable to an HTTP header injection. By sending a crafted HTTP request, a remote attacker may disclose sensitive information or request external resources from a vulnerable instance.
CWEs
- CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')