CVE-2020-11415

Severity: medium (CVSS 4.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-04-27 · updated 2026-06-17
Weakness: CWE-312

Description

An issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.17 and 3.x before 3.22.1. Admin users can retrieve the LDAP server system username/password (as configured in nxrm) in cleartext.

Affected products

Sonatype Nexus Repository 3: from 2.0 before 2.14.17; from 3.0 before 3.22.1 — fixed in 2.14.17, 3.22.1

How to fix

Upgrade to a fixed version: Sonatype Nexus Repository 3 2.14.17, 3.22.1. Check the vendor advisory for mitigations.

References

https://support.sonatype.com/hc/en-us/articles/360045360854
https://support.sonatype.com/hc/en-us/articles/360045360854

Get alerted when CVE-2020-11415 or the next vulnerability affects your stack