CVE-2021-29158 : Security Advisory and Response

Sonatype Nexus Repository Manager 3 Pro up to and including 3.30.0 has Incorrect Access Control.

Understanding CVE-2021-29158

This CVE identifies a security issue in Sonatype Nexus Repository Manager 3 Pro that allows incorrect access control.

What is CVE-2021-29158?

The CVE-2021-29158 vulnerability pertains to Incorrect Access Control in Sonatype Nexus Repository Manager 3 Pro versions up to and including 3.30.0.

The Impact of CVE-2021-29158

The vulnerability could lead to unauthorized access and potentially sensitive information exposure in affected systems.

Technical Details of CVE-2021-29158

The technical details include the following:

Vulnerability Description

Sonatype Nexus Repository Manager 3 Pro versions up to 3.30.0 are impacted by an Incorrect Access Control vulnerability.

Affected Systems and Versions

All versions of Sonatype Nexus Repository Manager 3 Pro up to and including 3.30.0 are affected by this vulnerability.

Exploitation Mechanism

Attackers could exploit this vulnerability to gain unauthorized access to resources and potentially compromise the integrity of the system.

Mitigation and Prevention

To address CVE-2021-29158, consider the following measures:

Immediate Steps to Take

Update Sonatype Nexus Repository Manager 3 Pro to version 3.30.1 or later.
Review and adjust access controls to reduce the risk of unauthorized access.

Long-Term Security Practices

Implement a robust access control policy and regularly monitor and audit system access for anomalies.

Patching and Updates

Stay informed about security updates for Sonatype Nexus Repository Manager and promptly apply patches to mitigate known vulnerabilities.