{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/nexus-repository-manager--2.15.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:sonatype:nexus_repository_manager:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2024-5082"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Nexus Repository Manager (\u003c= 2.15.1)"],"_cs_severities":["high"],"_cs_tags":["remote-code-execution","maven","supply-chain","sonatype","cve-2024-5082"],"_cs_type":"advisory","_cs_vendors":["Sonatype"],"content_html":"\u003cp\u003eCVE-2024-5082 is a remote code execution vulnerability affecting Sonatype Nexus Repository Manager 2 versions 2.15.1 and earlier. The vulnerability exists due to improper processing of Maven artifacts containing Velocity templates. An authenticated user with sufficient permissions to modify repository content can upload a crafted artifact and trigger the Velocity template engine, resulting in code execution within the security context of the Nexus JVM on the host server. Sonatype reports that this product reached end of life on June 30, 2025, and recommends migration to Nexus Repository 3.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker authenticates to the Nexus Repository Manager using valid credentials.\u003c/li\u003e\n\u003cli\u003eAttacker selects a hosted repository for which they have content update permissions.\u003c/li\u003e\n\u003cli\u003eAttacker uploads a malicious Maven-style artifact containing an embedded Velocity template.\u003c/li\u003e\n\u003cli\u003eAttacker modifies the artifact attributes via the Nexus API to force the content generator to process the template as \u003ccode\u003evelocity\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker triggers the template evaluation by requesting or accessing the uploaded artifact.\u003c/li\u003e\n\u003cli\u003eThe Nexus Repository Manager evaluates the Velocity template, leading to command execution on the host server.\u003c/li\u003e\n\u003cli\u003eThe process creates an outbound network connection (e.g., a reverse shell) from the Nexus host to the attacker-controlled listener.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in arbitrary command execution on the Nexus Repository host with the privileges of the Nexus JVM. While the vulnerability requires authentication, a compromised repository manager can lead to broader supply-chain contamination by allowing attackers to modify trusted artifacts or credentials stored within the repository.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMigrate from Nexus Repository Manager 2 to Nexus Repository 3 immediately, as version 2 is end-of-life and unsupported.\u003c/li\u003e\n\u003cli\u003eFor organizations unable to migrate immediately, upgrade to Nexus Repository Manager 2.15.2, which contains the fix for CVE-2024-5082.\u003c/li\u003e\n\u003cli\u003eAudit access logs for authenticated users performing anomalous API interactions, particularly those involving \u003ccode\u003emaven-metadata.xml\u003c/code\u003e or attribute updates related to Velocity processing.\u003c/li\u003e\n\u003cli\u003eRestrict repository write permissions to only those accounts and CI/CD service principals strictly requiring them.\u003c/li\u003e\n\u003cli\u003eMonitor for unexpected outbound network traffic (egress) originating from the Nexus Repository host server.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T18:57:28Z","date_published":"2026-10-29T18:57:28Z","id":"https://feed.craftedsignal.io/briefs/2026-10-nexus-rce-cve-2024-5082/","summary":"An authenticated remote code execution vulnerability in Sonatype Nexus Repository Manager 2 (up to 2.15.1) allows attackers to execute arbitrary code by uploading a malicious Maven artifact containing an evaluated Velocity template.","title":"Sonatype Nexus Repository Manager Remote Code Execution (CVE-2024-5082)","url":"https://feed.craftedsignal.io/briefs/2026-10-nexus-rce-cve-2024-5082/"}],"language":"en","title":"CraftedSignal Threat Feed - Nexus Repository Manager (\u003c= 2.15.1)","version":"https://jsonfeed.org/version/1.1"}