# CVE-2020-10199

Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).

- Page: https://www.vulneraibility.com/cve/CVE-2020-10199
- CVSS: 8.8
- Known exploited: yes, in CISA KEV since 2021-11-03; CISA due date 2022-05-03
- EPSS: 99.06% (percentile 99.9)
- Public exploit code: 2 on Exploit-DB · 1 Metasploit module · 7 GitHub proofs of concept · 1 Nuclei template (first 2020-04-07)
- CISA SSVC: exploitation active, automatable no, technical impact total (assessed 2025-02-04)
- Weakness: CWE-917
- Published: 2020-04-01

## Affected

- sonatype:nexus

## References

- [other] https://support.sonatype.com/hc/en-us/articles/360044882533
- [other] http://packetstormsecurity.com/files/157261/Nexus-Repository-Manager-3.21.1-01-Remote-Code-Execution.html
- [other] http://packetstormsecurity.com/files/160835/Sonatype-Nexus-3.21.1-Remote-Code-Execution.html
- [other] https://cwe.mitre.org/data/definitions/917.html
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-10199

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.