Nexus Repository 2 - Stored XSS
Priority LOW 23CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
A stored Cross-site Scripting vulnerability has been discovered in Sonatype Nexus Repository 2 This issue affects Nexus Repository 2 OSS/Pro versions up to and including 2.15.1.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00413 35th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Sonatype | Nexus Repository | 2.0.0 – 2.15.1 | — | No fix listed | CNA |
- Nexus Repository VendorSonatype Affected 2.0.0 – 2.15.1 Fixed in — No fix listed CNA
CPE names CNA · 63
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sonatype:nexus_repository_manager:2.0.0:*:*:*:*:*:*:* | 2.0.0 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.0.1:*:*:*:*:*:*:* | 2.0.1 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.0.2:*:*:*:*:*:*:* | 2.0.2 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.0.3:*:*:*:*:*:*:* | 2.0.3 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.0.4:*:*:*:*:*:*:* | 2.0.4 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.0.5:*:*:*:*:*:*:* | 2.0.5 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.0.6:*:*:*:*:*:*:* | 2.0.6 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.1.0:*:*:*:*:*:*:* | 2.1.0 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.1.1:*:*:*:*:*:*:* | 2.1.1 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.1.2:*:*:*:*:*:*:* | 2.1.2 | — | Sonatype |
- cpe:2.3:a:sonatype:nexus_repository_manager:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.0.1:*:*:*:*:*:*:* Versions 2.0.1 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.0.2:*:*:*:*:*:*:* Versions 2.0.2 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.0.3:*:*:*:*:*:*:* Versions 2.0.3 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.0.4:*:*:*:*:*:*:* Versions 2.0.4 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.0.5:*:*:*:*:*:*:* Versions 2.0.5 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.0.6:*:*:*:*:*:*:* Versions 2.0.6 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.1.0:*:*:*:*:*:*:* Versions 2.1.0 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.1.1:*:*:*:*:*:*:* Versions 2.1.1 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.1.2:*:*:*:*:*:*:* Versions 2.1.2 — ·Sonatype
Show 53 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sonatype:nexus_repository_manager:2.2.0:*:*:*:*:*:*:* | 2.2.0 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.2.1:*:*:*:*:*:*:* | 2.2.1 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.3.0:*:*:*:*:*:*:* | 2.3.0 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.3.1:*:*:*:*:*:*:* | 2.3.1 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.4.0:*:*:*:*:*:*:* | 2.4.0 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.5.0:*:*:*:*:*:*:* | 2.5.0 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.5.1:*:*:*:*:*:*:* | 2.5.1 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.6.0:*:*:*:*:*:*:* | 2.6.0 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.6.1:*:*:*:*:*:*:* | 2.6.1 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.6.2:*:*:*:*:*:*:* | 2.6.2 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.6.3:*:*:*:*:*:*:* | 2.6.3 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.6.4:*:*:*:*:*:*:* | 2.6.4 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.7.0:*:*:*:*:*:*:* | 2.7.0 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.7.1:*:*:*:*:*:*:* | 2.7.1 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.7.2:*:*:*:*:*:*:* | 2.7.2 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.8.0:*:*:*:*:*:*:* | 2.8.0 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.8.1:*:*:*:*:*:*:* | 2.8.1 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.9.0:*:*:*:*:*:*:* | 2.9.0 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.9.1:*:*:*:*:*:*:* | 2.9.1 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.9.2:*:*:*:*:*:*:* | 2.9.2 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.10.0:*:*:*:*:*:*:* | 2.10.0 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.11.0:*:*:*:*:*:*:* | 2.11.0 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.11.1:*:*:*:*:*:*:* | 2.11.1 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.11.2:*:*:*:*:*:*:* | 2.11.2 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.11.3:*:*:*:*:*:*:* | 2.11.3 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.11.4:*:*:*:*:*:*:* | 2.11.4 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.12.0:*:*:*:*:*:*:* | 2.12.0 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.12.1:*:*:*:*:*:*:* | 2.12.1 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.13.0:*:*:*:*:*:*:* | 2.13.0 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.14.0:*:*:*:*:*:*:* | 2.14.0 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.14.1:*:*:*:*:*:*:* | 2.14.1 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.14.2:*:*:*:*:*:*:* | 2.14.2 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.14.3:*:*:*:*:*:*:* | 2.14.3 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.14.4:*:*:*:*:*:*:* | 2.14.4 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.14.5:*:*:*:*:*:*:* | 2.14.5 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.14.6:*:*:*:*:*:*:* | 2.14.6 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.14.7:*:*:*:*:*:*:* | 2.14.7 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.14.8:*:*:*:*:*:*:* | 2.14.8 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.14.9:*:*:*:*:*:*:* | 2.14.9 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.14.10:*:*:*:*:*:*:* | 2.14.10 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.14.11:*:*:*:*:*:*:* | 2.14.11 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.14.12:*:*:*:*:*:*:* | 2.14.12 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.14.13:*:*:*:*:*:*:* | 2.14.13 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.14.14:*:*:*:*:*:*:* | 2.14.14 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.14.15:*:*:*:*:*:*:* | 2.14.15 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.14.16:*:*:*:*:*:*:* | 2.14.16 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.14.17:*:*:*:*:*:*:* | 2.14.17 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.14.18:*:*:*:*:*:*:* | 2.14.18 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.14.19:*:*:*:*:*:*:* | 2.14.19 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.14.20:*:*:*:*:*:*:* | 2.14.20 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.14.21:*:*:*:*:*:*:* | 2.14.21 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.15.0:*:*:*:*:*:*:* | 2.15.0 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:2.15.1:*:*:*:*:*:*:* | 2.15.1 | — | Sonatype |
- cpe:2.3:a:sonatype:nexus_repository_manager:2.2.0:*:*:*:*:*:*:* Versions 2.2.0 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.2.1:*:*:*:*:*:*:* Versions 2.2.1 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.3.0:*:*:*:*:*:*:* Versions 2.3.0 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.3.1:*:*:*:*:*:*:* Versions 2.3.1 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.4.0:*:*:*:*:*:*:* Versions 2.4.0 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.5.0:*:*:*:*:*:*:* Versions 2.5.0 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.5.1:*:*:*:*:*:*:* Versions 2.5.1 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.6.0:*:*:*:*:*:*:* Versions 2.6.0 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.6.1:*:*:*:*:*:*:* Versions 2.6.1 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.6.2:*:*:*:*:*:*:* Versions 2.6.2 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.6.3:*:*:*:*:*:*:* Versions 2.6.3 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.6.4:*:*:*:*:*:*:* Versions 2.6.4 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.7.0:*:*:*:*:*:*:* Versions 2.7.0 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.7.1:*:*:*:*:*:*:* Versions 2.7.1 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.7.2:*:*:*:*:*:*:* Versions 2.7.2 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.8.0:*:*:*:*:*:*:* Versions 2.8.0 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.8.1:*:*:*:*:*:*:* Versions 2.8.1 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.9.0:*:*:*:*:*:*:* Versions 2.9.0 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.9.1:*:*:*:*:*:*:* Versions 2.9.1 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.9.2:*:*:*:*:*:*:* Versions 2.9.2 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.10.0:*:*:*:*:*:*:* Versions 2.10.0 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.11.0:*:*:*:*:*:*:* Versions 2.11.0 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.11.1:*:*:*:*:*:*:* Versions 2.11.1 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.11.2:*:*:*:*:*:*:* Versions 2.11.2 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.11.3:*:*:*:*:*:*:* Versions 2.11.3 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.11.4:*:*:*:*:*:*:* Versions 2.11.4 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.12.0:*:*:*:*:*:*:* Versions 2.12.0 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.12.1:*:*:*:*:*:*:* Versions 2.12.1 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.13.0:*:*:*:*:*:*:* Versions 2.13.0 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.14.0:*:*:*:*:*:*:* Versions 2.14.0 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.14.1:*:*:*:*:*:*:* Versions 2.14.1 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.14.2:*:*:*:*:*:*:* Versions 2.14.2 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.14.3:*:*:*:*:*:*:* Versions 2.14.3 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.14.4:*:*:*:*:*:*:* Versions 2.14.4 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.14.5:*:*:*:*:*:*:* Versions 2.14.5 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.14.6:*:*:*:*:*:*:* Versions 2.14.6 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.14.7:*:*:*:*:*:*:* Versions 2.14.7 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.14.8:*:*:*:*:*:*:* Versions 2.14.8 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.14.9:*:*:*:*:*:*:* Versions 2.14.9 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.14.10:*:*:*:*:*:*:* Versions 2.14.10 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.14.11:*:*:*:*:*:*:* Versions 2.14.11 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.14.12:*:*:*:*:*:*:* Versions 2.14.12 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.14.13:*:*:*:*:*:*:* Versions 2.14.13 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.14.14:*:*:*:*:*:*:* Versions 2.14.14 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.14.15:*:*:*:*:*:*:* Versions 2.14.15 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.14.16:*:*:*:*:*:*:* Versions 2.14.16 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.14.17:*:*:*:*:*:*:* Versions 2.14.17 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.14.18:*:*:*:*:*:*:* Versions 2.14.18 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.14.19:*:*:*:*:*:*:* Versions 2.14.19 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.14.20:*:*:*:*:*:*:* Versions 2.14.20 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.14.21:*:*:*:*:*:*:* Versions 2.14.21 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.15.0:*:*:*:*:*:*:* Versions 2.15.0 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:2.15.1:*:*:*:*:*:*:* Versions 2.15.1 — ·Sonatype
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-5083
- 2026-10-03 Alias added: GHSA-w89v-rr8q-8jfc
References
More Sonatype vulnerabilities
- TI-2019-05133 Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control. KEVCVSS 3.1CRITICAL 9.8
- TI-2020-08218 Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2). KEVCVSS 3.1HIGH 8.8
- TI-2020-08220 Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution. CVSS 3.1HIGH 7.2
- TI-2024-04604 Nexus Repository 3 - Path Traversal CVSS 3.1HIGH 7.5
- TI-2019-03883 OS command injection in Nexus Repository Manager CVSS 3.0HIGH 8.8
- TI-2026-02763 Nexus Repository 3 - Authenticated Remote Code Execution via Task Property Injection CVSS 4.0CRITICAL 9.4
Sources
- CVE-2024-5083 · CVE Program
- CVE-2024-5083 · NVD
- FIRST EPSS
- GHSA-w89v-rr8q-8jfc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences