CVE-2021-29159

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2021-29159

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-29159.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2021-29159

Published

2021-04-28T14:15:07.657Z

Modified

2025-11-14T11:37:00.507682Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

[none]

Details

A cross-site scripting (XSS) vulnerability has been discovered in Nexus Repository Manager 3.x before 3.30.1. An attacker with a local account can create entities with crafted properties that, when viewed by an administrator, can execute arbitrary JavaScript in the context of the NXRM application.

References

Affected packages

Git / github.com/sonatype/nexus-public

Affected ranges

Type: GIT
Repo: https://github.com/sonatype/nexus-public
Events: Introduced

8cb94096e435ce444b65ef98e55074635ab7307c

Fixed

8a348400fdb5c375682a0620bc2dda94def1c27d

Affected versions

release-3.*

release-3.23.0-03

release-3.24.0-02

release-3.25.0-03

release-3.25.1-02

release-3.26.0-04

release-3.26.1-02

release-3.27.0-03

release-3.28.0-01

release-3.28.1-01

release-3.29.0-02

release-3.29.1-01

release-3.29.2-02

release-3.30.0-01

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-29159.json"