CVE-2026-17598

Katalog CVE

CVSS 4.9 · Medium EPSS 0,23%

Kerentanan Improperly Controlled Modification of Dynamically-Determined Object Attributes pada sonatype nexus repository manager. Skor CVSS 3.1 4.9 (Medium) menurut NVD.

Deskripsi (NVD)

Sonatype Nexus Repository 3 did not properly filter internal configuration keys from user-supplied task properties when creating or updating a scheduled task through the administrative UI. An account holding permission to create at least one scheduled task type could supply a crafted property value that caused the system to overwrite the configuration of an unrelated, existing task instead of creating a new one.

Rincian

Terbit di NVD

7 Agustus 2026

Terakhir diubah

22 September 2026

Status NVD

Analyzed

CVSS 3.1

4.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes

EPSS (30 hari)

0,23% peluang dieksploitasi; lebih tinggi dari 12,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://support.sonatype.com/hc/en-us/articles/53880086360211/ advisory vendor
• https://help.sonatype.com/en/sonatype-nexus-repository-3-95-0-release-notes.html release notes