CVE-2026-14646

Katalog CVE

CVSS 7.7 · High EPSS 0,26%

Kerentanan Server-Side Request Forgery (SSRF) pada sonatype nexus repository manager. Skor CVSS 3.1 7.7 (High) menurut NVD.

Deskripsi (NVD)

Nexus Repository 3 did not apply its existing Server-Side Request Forgery (SSRF) protections to HTTP redirect targets returned by proxy repository upstream servers. Any user with read access to a proxy repository backed by an attacker-controlled or compromised upstream server — including an anonymous user, if anonymous access is enabled — could receive a response from an internal network address or cloud metadata endpoint as repository content, potentially exposing sensitive information such as cloud IAM credentials.

Rincian

Terbit di NVD

14 Juli 2026

Terakhir diubah

22 September 2026

Status NVD

Analyzed

CVSS 3.1

7.7 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,26% peluang dieksploitasi; lebih tinggi dari 17,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://support.sonatype.com/hc/en-us/articles/53165019641363/ advisory vendor
• https://help.sonatype.com/en/sonatype-nexus-repository-3-94-0-release-notes.html permissions required