CVE-2020-15012

Severity: high (CVSS 8.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-10-12 · updated 2026-06-17
Weakness: CWE-22

Description

A Directory Traversal issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.19. A user that requests a crafted path can traverse up the file system to get access to content on disk (that the user running nxrm also has access to).

Affected products

Sonatype Nexus Repository 3: from 2.0 before 2.14.19 — fixed in 2.14.19

How to fix

Upgrade to a fixed version: Sonatype Nexus Repository 3 2.14.19. Check the vendor advisory for mitigations.

References

https://support.sonatype.com/hc/en-us/articles/360051068253
https://support.sonatype.com/hc/en-us/articles/360051068253

Get alerted when CVE-2020-15012 or the next vulnerability affects your stack