CyberRota Analysis
AI-GeneratedNexus Repository 3 is vulnerable due to insufficient sandboxing of JEXL expressions in Content Selectors, allowing users with the nexus:selectors:create permission to access sensitive internal JVM class metadata. While this vulnerability does not enable method invocation or arbitrary code execution, it can lead to information disclosure that may aid in further attacks. Organizations using Nexus Repository 3 should prioritize patching this issue to mitigate potential risks associated with unauthorized data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Nexus Repository 3 did not fully sandbox JEXL expressions used in Content Selectors. An account holding the nexus:selectors:create permission could construct an expression that read Java object properties not intended to be exposed to the expression engine, disclosing internal JVM class metadata such as class and classloader names. This issue does not permit method invocation, object construction, or arbitrary code execution. This has been fixed by restricting property access in the JEXL sandbox to the intended data types.