Vulnerability · Published Oct 23, 2024 · Assigned by Sonatype

CVE-2024-5764Nexus Repository 3 - Static hard-coded encryption passphrase used by default

Medium 5.9

In plain English

A medium-severity hard-coded credentials in Nexus Repository from Sonatype. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 4.0)5.9Medium

Exploit odds (30 days)0.4%top 66.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Use of Hard-coded Credentials vulnerability in Sonatype Nexus Repository has been discovered in the code responsible for encrypting any secrets stored in the Nexus Repository configuration database (SMTP or HTTP proxy credentials, user tokens, tokens, among others). The affected versions relied on a static hard-coded encryption passphrase. While it was possible for an administrator to define an alternate encryption passphrase, it could only be done at first boot and not updated. This issue affects Nexus Repository: from 3.0.0 through 3.72.0.

Affected products (as reported)

Vendor	Product	Versions
Sonatype	Nexus Repository	3.0.0 – through 3.72.0

Weakness: CWE-798 · Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://support.sonatype.com/hc/en-us/articles/34496708991507 vendor-advisory