CVE-2020-10199
RCE in Sonatype Nexus ≤ 3.21.2
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2020-10199 is a high-severity Expression Language Injection (CWE-917) vulnerability in Sonatype Nexus. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 0.1% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
Sonatype Nexus Repository versions prior to 3.21.2 contain a Java Expression Language (JavaEL) injection vulnerability, tracked as CWE-917. The flaw resides in the repository manager's handling of certain inputs that are evaluated as EL expressions, affecting the core application component used for artifact storage and management.
An attacker with low-privileged authenticated network access can supply crafted input that triggers remote code execution. The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates that successful exploitation yields complete compromise of confidentiality, integrity, and availability without user interaction.
Public exploit code demonstrating remote code execution against version 3.21.1-01 has been posted to PacketStorm, and Sonatype has published remediation guidance at the referenced support article. Upgrading to 3.21.2 or later eliminates the injection issue.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-0379
Vulnerability Data
Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).
- CWE(s)
- KEV Date Added
- 03 November 2021
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.1.2V1.3.2V1.3.5V4.3.1
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input neutralization and safe EL construction to prevent injection flaws.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development and acceptance can detect EL injection but does not itself implement the fix.
Secure SDLC mandates input validation and output encoding that directly prevent expression-language injection.
Application security requirements explicitly call for controls against injection flaws including EL injection.
Secure architecture principles reduce the attack surface but do not prescribe the specific neutralization techniques needed.
Secure coding standards require proper escaping and parameterization of expression-language statements.