CVE-2026-11403

Katalog CVE

CVSS 7.5 · High EPSS 0,32%

Kerentanan Insufficient Entropy pada sonatype nexus repository manager. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

A vulnerability in Sonatype Nexus Repository Manager's format-specific API key generation may allow a remote attacker to gain unauthorized access to repository operations as a targeted user. A format-specific API key realm (NuGet API Key, Docker Bearer Token, or npm Bearer Token) must be enabled and the targeted user must have an active API key for this vulnerability to be exploitable.

Rincian

Terbit di NVD

14 Juli 2026

Terakhir diubah

22 September 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-331: Insufficient Entropy

EPSS (30 hari)

0,32% peluang dieksploitasi; lebih tinggi dari 22,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://support.sonatype.com/hc/en-us/articles/52347011450515/ advisory vendor
• https://help.sonatype.com/en/sonatype-nexus-repository-3-93-0-release-notes.html release notes