CVE-2020-10199

Sonatype Nexus Repository Remote Code Execution Vulnerability

Published Apr 1, 2020 · updated Jun 16, 2026 · sonatype nexus

Sonatype Nexus Repository contains an unspecified vulnerability that allows for remote code execution.

Timeline

Detection, updates, and resolution for this record.

Apr 1, 2020 · Catalog
Detected
Sonatype Nexus Repository contains an unspecified vulnerability that allows for remote code execution.
Nov 3, 2021 · CISA KEV
Known exploited
Apply updates per vendor instructions.
May 3, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
Sonatype Nexus Repository contains an unspecified vulnerability that allows for remote code execution.

Apply updates per vendor instructions.

CISA due date May 3, 2022

CISA KEVCVE-2020-10199
Sonatype Nexus Repository contains an unspecified vulnerability that allows for remote code execution.
cisa.gov
CVE.orgCVE-2020-10199
Official CVE identifier
cve.org
FIRST EPSSCVE-2020-10199
30-day exploitation probability 99.1%
first.org
Exploit Database48343
Public archive entry. The exploit body is not stored here.
exploit-db.com
Exploit Database49385
Public archive entry. The exploit body is not stored here.
exploit-db.com
Metasploit Modulesexploit_linux/http/nexus_repo_manager_el_injection
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com
NIST NVDCVE-2020-10199
Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).
nvd.nist.gov
Packet Storm Securityhttp://packetstormsecurity.com/files/157261/Nexus-Repository-Manager-3.21.1-01-Remote-Code-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com
Packet Storm Securityhttp://packetstormsecurity.com/files/160835/Sonatype-Nexus-3.21.1-Remote-Code-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com