CVE-2021-40143
HighCVSS 8.2Exploitation Probability (EPSS)
High risk83th percentile - higher than 83% of all known CVEs
Summary
Sonatype Nexus Repository 3.x through 3.33.1-01 is vulnerable to an HTTP header injection. By sending a crafted HTTP request, a remote attacker may disclose sensitive information or request external resources from a vulnerable instance.
Risk Assessment
The risk is the possibility of disclosing sensitive data or using the instance as a tool for attacks on external resources, which could compromise information security.
Recommendation
Update Sonatype Nexus Repository to a version later than 3.33.1-01 and restrict access to the instance to trusted clients only.
Other vulnerabilities in Sonatype Nexus Repository
See all- CVE-2020-10199HighActively exploited
Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).
- CVE-2026-77125High
In Sonatype Nexus Repository 3, two blobstore group management REST API endpoints did not correctly enforce authorization. A user with only nexus:blobstores:create permission could convert an existing blobstore into a group blobstore, an action requiring nexus:blobstores:update. This could lead to unauthorized modification of blobstore configuration.
- CVE-2026-77124High
In affected versions of Nexus Repository 3, the script execution endpoint did not verify whether script execution had been administratively disabled. An account with script-execution permission could continue to run previously-created scripts even after nexus.scripts.allowCreation=false, undermining the expectation that this setting fully blocks script execution.
- CVE-2026-10748High
An authenticated user with the nx-licensing-create privilege can upload a specially crafted license file to execute arbitrary operating system commands as the Nexus process user in Sonatype Nexus Repository 3 versions before 3.92.0.
- CVE-2026-3329High
A vulnerability in Sonatype Nexus Repository allows a remote unauthenticated attacker to perform credential-guessing attacks against user accounts via authentication endpoints.
- CVE-2026-7308Medium
In Sonatype Nexus Repository versions 3.6.0 through before 3.92.0, an authenticated user with upload permission to a hosted repository can store content that causes arbitrary JavaScript execution in the browser of any user browsing that repository directory via the HTML index page. This could allow the attacker to perform actions in the context of the victim's session.
- CVE-2026-3438Medium
Sonatype Nexus Repository versions 3.0.0 through 3.90.2 contain a reflected cross-site scripting vulnerability that allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser through a specially crafted URL. Exploitation requires user interaction.
- CVE-2026-3199High
A vulnerability in the task management component of Sonatype Nexus Repository versions 3.22.1 through 3.90.2 allows an authenticated attacker with task creation permissions to execute arbitrary code, bypassing the nexus.scripts.allowCreation security control.
Original NVD description (English source)
Sonatype Nexus Repository 3.x through 3.33.1-01 is vulnerable to an HTTP header injection. By sending a crafted HTTP request, a remote attacker may disclose sensitive information or request external resources from a vulnerable instance.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS