high8.2
CVE-2021-40143
HTTP header injection in Sonatype Nexus Repository
Impact
Sonatype Nexus Repository 3.x through 3.33.1-01 is vulnerable to an HTTP header injection. By sending a crafted HTTP request, a remote attacker may disclose sensitive information or request external resources from a vulnerable instance.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.sonatype.nexus:nexus-repository | >= 3.0.0, <= 3.33.1-01 | 3.34.0-01 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sonatype | Nexus Repository Manager | from 3.0.0 before 3.34.1-01 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://issues.sonatype.org/secure/ReleaseNote.jspa
- https://support.sonatype.com/hc/en-us/articles/4405941762579
- https://github.com/advisories/GHSA-f34x-8pf6-qc9c
- https://nvd.nist.gov/vuln/detail/CVE-2021-40143
- https://help.sonatype.com/repomanager3/release-notes/2021-release-notes