CVE-2018-5306 Cross-site scripting in n/a

Medium 6.1 Published 9 Feb 2018 Updated 5 Aug 2024

Remote attackers can inject arbitrary web script or HTML via multiple parameters in Sonatype Nexus Repository Manager, potentially leading to session hijacking or malicious actions.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2018-5306?

CVE-2018-5306 is a medium-severity cross-site scripting vulnerability in Sonatype Nexus Repository Manager, published on 9 Feb 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Multiple cross-site scripting (XSS) vulnerabilities in Sonatype Nexus Repository Manager (aka NXRM) 3.x before 3.8 allow remote attackers to inject arbitrary web script or HTML via (1) the repoId or (2) format parameter to service/siesta/healthcheck/healthCheckFileDetail/.../index.html; (3) the filename in the "File Upload" functionality of the Staging Upload; (4) the username when creating a new user; or (5) the IQ Server URL field in the IQ Server Connection functionality.

Weakness: CWE-79

Which versions are affected by CVE-2018-5306?

It affects 1 product.

Products include Sonatype Nexus Repository Manager.

How do I fix CVE-2018-5306?

No fix has been published for CVE-2018-5306 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2018-5306 being exploited?

There is no known exploitation of CVE-2018-5306 in the wild and no public exploit code.

All Sonatype Nexus Repository Manager vulnerabilities

Sources

Also known as GHSA-2pwx-xq5x-gj68.