Detections
Analytics
FreeBSD : nexus2-oss -- Multiple vulerabilities (b2f9573a-008c-11ea-9801-10c37b4ac2ea)
high Nessus Plugin ID 130632
Language:
Synopsis
The remote FreeBSD host is missing a security-related update.Description
Sonatype reports :Several RCE vulnerabilities have been found and corrected in 2.14.15 :
CVE-2019-16530: An attacker with elevated privileges can upload a specially crafted file. That file can contain commands that will be executed on the system, with the same privileges as the user running the server.
CVE-2019-15893: A Remote Code Execution vulnerability has been discovered in Nexus Repository Manager requiring immediate action. The vulnerability allows for an attacker with administrative access to NXRM to create repostories that can grant access to read/execute system data outside the scope of NXRM.
CVE-2019-5475: A vulnerability has been found that can allow user's with administrative privileges to run processes on the target server, that the nxrm os user has access to.
Solution
Update the affected package.See Also
Plugin Details
Severity: High
ID: 130632
File Name: freebsd_pkg_b2f9573a008c11ea980110c37b4ac2ea.nasl
Version: 1.3
Type: local
Family: FreeBSD Local Security Checks
Published: 11/8/2019
Updated: 4/15/2024
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: High
Base Score: 9
Temporal Score: 7
Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C
CVSS Score Source: CVE-2019-5475
CVSS v3
Risk Factor: High
Base Score: 8.8
Temporal Score: 7.9
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
CPE: p-cpe:/a:freebsd:freebsd:nexus2-oss, cpe:/o:freebsd:freebsd
Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 11/7/2019
Vulnerability Publication Date: 9/19/2019