Veille CVE

‹ Retour à la liste

CVE-2026-17594

4.9 Moyenne

Publiée le 07/08/2026 à 19:16 · Modifiée le 22/09/2026 à 19:01 · Analysée par le NVD · Source : 103e4ec9-0a87-450b-af77-479448ddef11

Description

Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x contain an incorrect authorization vulnerability (CWE-863) in the repository-creation user interface. An individual user account holding a delegated repository-admin privilege scoped to a specific repository format could create a repository of a different, unauthorized format, because authorization was checked against one request field while a separate, attacker-controlled field determined the repository format actually created. This does not affect the anonymous user, which cannot hold this privilege by default. Fixed in version 3.95.0.

Traduire en français

Produits concernés

Scores CVSS

VersionScoreSourceVecteur
4.0 8.2 Élevée 103e4ec9-0a87-450b-af77-479448ddef11 CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
3.1 4.9 Moyenne nvd@nist.gov (NVD) CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Faiblesses (CWE)

Références

Ailleurs