How is the Nexus2 yum plug-in RCE vulnerability CVE-2019-5475 reproduced?
In this issue, Xiaobian will bring you about how Nexus2 yum plug-in RCE vulnerability CVE-2019-5475 recurs. The article is rich in content and analyzed and described from a professional perspective. After reading this article, I hope you can gain something.
0x01 Vulnerability Overview
Recently, hackerone disclosed the details of Nexus Repository Manager 2.X vulnerability. This vulnerability has deployment permission account by default. After successful login, you can use "createrepo" or "mergerepo" to customize configuration, which can trigger remote command execution vulnerability.
0x02 Impact Version
Nexus Repository Manager OSS
