CVSS 3.1
8.2 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:NCVE-2021-40143
High (8.2) in sonatype nexus repository manager. EPSS 2.3% chance of exploitation in the next 30 days. Fixed in org.sonatype.nexus:nexus-repository 3.34.0-01.
Sonatype Nexus Repository 3.x through 3.33.1-01 is vulnerable to an HTTP header injection. By sending a crafted HTTP request, a remote attacker may disclose sensitive information or request external resources from a vulnerable instance.
Severity
- EPSS
- 2.3% chance of exploitation in the next 30 days; higher than 83% of CVEs (scores of 2026-10-31)
- CWE
- CWE-74
- Published
- Modified
- Record from
- the NVD, synced
Affected
- sonatype:nexus_repository_manager
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-f34x-8pf6-qc9c | Maven | org.sonatype.nexus:nexus-repository | >=3.0.0 <3.34.0-01 | 3.34.0-01 |