CVE-2026-17599

Katalog CVE

CVSS 7.2 · High EPSS 0,34%

Kerentanan Unverified Password Change pada sonatype nexus repository manager. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

Nexus Repository 3 contained an endpoint used to change the administrator account password during initial onboarding. This endpoint did not verify that onboarding was still in progress before allowing the password change, relying instead on the presence of a local onboarding artifact. As a result, an account holding the nexus:* permission could invoke the endpoint outside the intended onboarding flow to replace the administrator password, and existing sessions were not invalidated after the change.

Rincian

Terbit di NVD

7 Agustus 2026

Terakhir diubah

22 September 2026

Status NVD

Analyzed

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-620: Unverified Password Change

EPSS (30 hari)

0,34% peluang dieksploitasi; lebih tinggi dari 25,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://support.sonatype.com/hc/en-us/articles/53884654627475/ advisory vendor
• https://help.sonatype.com/en/sonatype-nexus-repository-3-95-0-release-notes.html release notes