CVE-2020-11444
HIGHSonatype Nexus Repository Manager 3.0.0-3.21.2 - Incorrect Access Control
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2020-11444. PoCs published by zhzyker, CN016.
AI-analyzed exploit summary This repository contains a Python script that exploits CVE-2020-11444, an unauthorized vulnerability in Nexus Repository Manager 3.x, allowing an attacker to change the admin password without proper authentication.
Description
Sonatype Nexus Repository Manager 3.x up to and including 3.21.2 has Incorrect Access Control.
Exploits (2)
This repository contains a Python script that exploits CVE-2020-11444, an unauthorized vulnerability in Nexus Repository Manager 3.x, allowing an attacker to change the admin password without proper authentication.
This PoC exploits CVE-2020-11444, an authentication bypass vulnerability in Nexus Repository Manager 3, allowing an attacker to change the admin password without proper authorization. The script sends a PUT request to the vulnerable endpoint with a new password, leveraging a valid session ID.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H