CVE-2019-15588 Command injection in Nexus Repository Manager
An OS command injection vulnerability in Nexus Repository Manager allows attackers to execute arbitrary code remotely via user-supplied data.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-15588?
CVE-2019-15588 is a high-severity command injection vulnerability in Sonatype Nexus Repository Manager, published on 1 Nov 2019. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
There is an OS Command Injection in Nexus Repository Manager <= 2.14.14 (bypass CVE-2019-5475) that could allow an attacker a Remote Code Execution (RCE). All instances using CommandLineExecutor.java with user-supplied data is vulnerable, such as the Yum Configuration Capability.
Which versions are affected by CVE-2019-15588?
It affects 1 product.
Products include Sonatype Nexus Repository Manager.
How do I fix CVE-2019-15588?
No fix has been published for CVE-2019-15588 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2019-15588 being exploited?
There is no known exploitation of CVE-2019-15588 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Sonatype Nexus Repository Manager
- CVE-2019-7238 Sonatype Nexus Repository Manager Incorrect Access Control
- CVE-2019-9629 Hardcoded credentials in n/a
- CVE-2017-17717 Hardcoded credentials in n/a
- CVE-2026-3199 Nexus Repository 3 - Authenticated Remote Code Execution via Task Property Injection
- CVE-2026-5189 Nexus Repository 3 - Hardcoded Credential in Internal Database Component
Sources
Also known as GHSA-h8gj-qmf3-67wf.