CVE-2019-5475 OS Command Injection in Nexus Yum Repository Plugin

What is CVE-2019-5475?

CVE-2019-5475 is a high-severity command injection vulnerability in Sonatype Nexus Repository Manager, published on 3 Sep 2019. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The Nexus Yum Repository Plugin in v2 is vulnerable to Remote Code Execution when instances using CommandLineExecutor.java are supplied vulnerable data, such as the Yum Configuration Capability.

Weakness: CWE-78

Which versions are affected by CVE-2019-5475?

2 open source packages ship an affected version, including org.sonatype.nexus.plugins:nexus-yum-repository-plugin. It affects 1 product.

Products include Sonatype Nexus Repository Manager.

How do I fix CVE-2019-5475?

Upgrade org.sonatype.nexus.plugins:nexus-yum-repository-plugin to 2.14.14 or later.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2019-5475 being exploited?

There is no known exploitation of CVE-2019-5475 in the wild and no public exploit code.

Public exploit code: 3 proofs of concept on GitHub.

Other vulnerabilities in Sonatype Nexus Repository Manager

• CVE-2019-7238 Sonatype Nexus Repository Manager Incorrect Access Control Exploited Critical 9.8
• CVE-2019-9629 Hardcoded credentials in n/a Critical 9.8
• CVE-2017-17717 Hardcoded credentials in n/a Critical 9.8
• CVE-2026-3199 Nexus Repository 3 - Authenticated Remote Code Execution via Task Property Injection Critical 9.4
• CVE-2026-5189 Nexus Repository 3 - Hardcoded Credential in Internal Database Component Critical 9.2

All Sonatype Nexus Repository Manager vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-g5m7-57ph-j6p8.