CVE-2020-10199 Sonatype Nexus
| Affected software | Sonatype Nexus |
|---|---|
| Severity | 8.8 High CVSS 3.1 3 scores |
| Fixed in | 3.21.2 |
| Weakness | Expression language injection (CWE-917) |
| Published | 1 Apr 2020 |
| Updated | 29 Sep 2026 |
Description
Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).
Exploitation status
Exploited
Confirmed real-world exploitation.
Exploitation status
- CISA KEV listed Confirmed exploitation in the wild. Added 2021-11-03 · remediation due 2022-05-03 · ransomware use: unknown
- VulnCheck KEV listed Exploitation reported in the wild. 1 citation · honeypot sightings · 7 exploits · earliest 2021-11-03.
- CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: no, technical impact: total.
- Indexed PoC 10 indexed Published artifacts you can open, in Exploit-DB, GitHub PoC, Metasploit, Nuclei; first seen 2020-04-07.
- EPSS 99% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.
VulnCheck KEV
Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2020-10199 in VulnCheck (free account), which lists 2 more exploit references not shown here.
| Evidence | Source | Detail | Date |
|---|---|---|---|
| Honeypot sighting | Shadowserver honeypots | Exploitation attempts seen on 274 days | 2023-11-14 to 2026-10-12 |
| Reported exploitation | cisa.gov | /sites/default/files/feeds/known_exploited_vulnerabilities.json | 2021-11-03 |
| Exploit reference | VulnCheck XDB e457b012fb57 | Exploit type: remote-with-credentials | 2020-04-01 |
| Exploit reference | VulnCheck XDB 9976ab7ad418 | Exploit type: infoleak | 2020-04-07 |
| Exploit reference | VulnCheck XDB 048585ad5357 | Exploit type: remote-with-credentials | 2020-04-08 |
| Exploit reference | VulnCheck XDB 7f2c12104507 | Exploit type: remote-with-credentials | 2020-04-16 |
| Exploit reference | VulnCheck XDB ae19d3a890a2 | Exploit type: remote-with-credentials | 2020-05-15 |
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| GitHub PoC | CVE-2020-10199 Nexus <= 3.21.1 远程代码执行脚本(有回显) | 43 | 2020-04-16 |
| GitHub PoC | CVE-2020-10199、CVE-2020-10204、CVE-2020-11444 | 35 | 2020-04-08 |
| GitHub PoC | CVE-2020-10199 回显版本 | 31 | 2020-05-15 |
| GitHub PoC | CVE-2020-10199、CVE-2020-10204漏洞一键检测工具，图形化界面。CVE-2020-10199 and CVE-2020-10204 Vul Tool with GUI. | 25 | 2020-04-08 |
| GitHub PoC | CVE-2020-10199 CVE-2020-10204 Python POC | 19 | 2020-04-07 |
| GitHub PoC | Sonatype Nexus 3.21.01 - Remote Code Execution (Authenticated - Updated) | 2023-06-13 | |
| Exploit-DB | Sonatype Nexus 3.21.1 - Remote Code Execution (Authenticated) | 2021-01-06 | |
| Exploit-DB | Nexus Repository Manager - Java EL Injection RCE (Metasploit) | 2020-04-17 | |
| Metasploit | Nexus Repository Manager Java EL Injection RCE (excellent rank) | ||
| Nuclei | Sonatype Nexus Repository Manager 3 - Remote Code Execution |
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full Process
- Action available security rule
- Review human Researcher
- Record active
| Decided by | A researcher's recorded decision for this specific CVE |
|---|---|
| Finding | A researcher found this CVE protected by the ARMR Process rule. |
Waratek research note
written 2026-11-13Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.
Comments
Rule Name: ARMR Process rule
Nexus JavaEL injection (CWE-917) via group.memberNames. The Process rule (with /bin/* and /usr/* listed) blocks the Runtime.exec every public exploit makes. An expression that reads files or data directly in Java, without starting a program, is not stopped.
How to mitigate CVE-2020-10199
Upgrade Sonatype Nexus to 3.21.2 or later. Until you can, Waratek RASP blocks exploitation with its process rule. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
CVSS
8.8 HIGH
v3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
3 metrics
CVSS
8.8 HIGH v3.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
3 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 8.8 | HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
NVD | Primary | published |
| CVSS 3.1 | 8.8 | HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
CISA-ADP | Secondary | |
| CVSS 2.0 | 9.0 | none | AV:N/AC:L/Au:S/C:C/I:C/A:C |
NVD | Primary |
Affected software and releases
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.sonatype.nexus:nexus-extdirect |
0 | 3.21.2 |
unbounded |
Products and versions
2 products, 2 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| osv | org.sonatype.nexus | nexus-extdirect | generic | ＜ 3.21.2 |
| nvd | sonatype | nexus | generic | ＜ 3.21.2 |
References
Timeline
Timeline
| Published | 2020-04-01 | By the CVE Program. |
|---|---|---|
| Added to CISA KEV | 2021-11-03 | Listed in CISA's Known Exploited Vulnerabilities catalog. |
| VulnCheck KEV: earliest evidence | 2021-11-03 | Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE. |
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |
| Last VRT activity | 2026-09-29 | Most recent commit touching this CVE's classification, patch or rule file. |
| VulnCheck KEV: latest evidence | 2026-10-12 | Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record. |
| Classification created | 2026-11-13 | First commit adding this CVE's research note. |