Description (CNA)
Sonatype Nexus Repository 3 did not properly filter internal configuration keys from user-supplied task properties when creating or updating a scheduled task through the administrative UI. An account holding permission to create at least one scheduled task type could supply a crafted property value that caused the system to overwrite the configuration of an unrelated, existing task instead of creating a new one.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Sonatype / Nexus Repository 3 | affected 3.91.0 before 3.95.0 |
CWE
CWE-915
References
- https://help.sonatype.com/en/sonatype-nexus-repository-3-95-0-release-notes.html
- https://support.sonatype.com/hc/en-us/articles/53880086360211/
ADP enrichment
No English description supplied.
No references supplied.