CVE-2026-17600

Katalog CVE

CVSS 8.8 · High EPSS 0,25%

Kerentanan Insufficient Session Expiration pada sonatype nexus repository manager. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Sonatype Nexus Repository 3 did not immediately terminate a user's active login session or revoke their cached permissions when that user's account was deleted, deactivated, or had its password changed. A user whose account was already logged in at the time of one of these actions could continue using their existing session to interact with the repository as though the account were still active, until that session independently expired. Depending on the permissions previously held, this could allow continued unauthorized access to read, modify, or delete repository content after access was intended to be revoked.

Rincian

Terbit di NVD

7 Agustus 2026

Terakhir diubah

22 September 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-613: Insufficient Session Expiration

EPSS (30 hari)

0,25% peluang dieksploitasi; lebih tinggi dari 14,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://support.sonatype.com/hc/en-us/articles/53888843674003/ advisory vendor
• https://help.sonatype.com/en/sonatype-nexus-repository-3-95-0-release-notes.html release notes