CVE-2020-10204
Remote Code Execution - JavaEL Injection (low privileged accounts) in Nexus Repository Manager
Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution.
- Record
CVE-2020-10204- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 9.0 High
AV:N/AC:L/Au:S/C:C/I:C/A:C - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution.
- Record
CVE-2020-10204- Updated
- 2026-11-02
EUVDEUVD-2020-0371 No score
Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution.
- Record
EUVD-2020-0371- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8h56-v53h-5hhj
Remote Code Execution - JavaEL Injection (low privileged accounts) in Nexus Repository Manager
Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution.
- Record
GHSA-8h56-v53h-5hhj- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-8h56-v53h-5hhj
Remote Code Execution - JavaEL Injection (low privileged accounts) in Nexus Repository Manager
Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution.
- Record
GHSA-8h56-v53h-5hhj- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.sonatype.nexus:nexus-coreMaven |
before 3.21.2 | 3.21.2 |
org.sonatype.nexus:nexus-coreMaven |
before 3.21.2, plus listed versions 2.10.0-012.10.0-022.11.0-012.11.0-022.11.1-01 Show 45 moreShow less2.11.2-012.11.2-032.11.2-042.11.2-062.11.3-012.11.4-012.12.0-012.12.1-012.13.0-012.14.0-012.14.1-012.14.10-012.14.11-012.14.12-022.14.13-012.14.14-012.14.15-012.14.16-012.14.17-012.14.18-012.14.19-012.14.2-012.14.20-012.14.20-022.14.21-022.14.3-022.14.4-012.14.4-032.14.5-022.14.6-022.14.7-012.14.8-012.14.9-012.15.0-042.15.1-022.15.2-032.16.0-012.4.0-032.4.0-042.4.0-052.4.0-062.4.0-072.4.0-082.4.0-092.4.0-1 |
3.21.2 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | zhzyker/CVE-2020-10204 | 2020-05-27 |
| Nuclei | Sonatype Nexus Repository Manager 3 - Remote Code Execution |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploits, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, Nuclei, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-10204 is a high vulnerability (CVSS 7.2) in Sonatype Nexus, published April 1, 2020. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 38.4%, the 98th percentile. Fixed in org.sonatype.nexus:nexus-core 3.21.2.
References
support.sonatype.com/hc/en-us/articles/360044356194
nvd.nist.gov/vuln/detail/CVE-2020-10204
securitylab.github.com/advisories/GHSL-2020-011-nxrm-sonatype
github.com/advisories/GHSA-8h56-v53h-5hhj
Left out here: 90 versions. The JSON record has them.