Nexus Repository 3 JEXL Sandbox Property-Read Bypass (CVE-2020-17095) Advisory

CVE-2020-17095 Nexus Repository 3 - JEXL Content Selector Sandbox Property-Read Bypass Vulnerability Overview A vulnerability in Nexus Repository 3 allows bypass of the JEXL content selector sandbox to read properties. Affected Versions Nexus Repository 3 version 3.15.2-01 and prior Nexus Repository 3 version 3.16.0-01 and prior Nexus Repository 3 version 3.17.0-01 and prior Nexus Repository 3 version 3.18.0-01 and prior Nexus Repository 3 version 3.19.0-01 and prior Nexus Repository 3 version 3.20.0-01 and prior Nexus Repository 3 version 3.21.0-01 and prior Nexus Repository 3 version 3.22.0-01 and prior Nexus Repository 3 version 3.23.0-01 and prior Nexus Repository 3 version 3.24.0-01 and prior Nexus Repository 3 version 3.25.0-01 and prior Nexus Repository 3 version 3.26.0-01 and prior Nexus Repository 3 version 3.27.0-01 and prior Nexus Repository 3 version 3.28.0-01 and prior Nexus Repository 3 version 3.29.0-01 and prior Nexus Repository 3 version 3.30.0-01 and prior Nexus Repository 3 version 3.31.0-01 and prior Nexus Repository 3 version 3.32.0-01 and prior Nexus Repository 3 version 3.33.0-01 and prior Nexus Repository 3 version 3.34.0-01 and prior Nexus Repository 3 version 3.35.0-01 and prior Nexus Repository 3 version 3.36.0-01 and prior Nexus Repository 3 version 3.37.0-01 and prior Nexus Repository 3 version 3.38.0-01 and prior Nexus Repository 3 version 3.39.0-01 and prior Nexus Repository 3 version 3.40.0-01 and prior Nexus Repository 3 version 3.41.0-01 and prior Nexus Repository 3 version 3.42.0-01 and prior Nexus Repository 3 version 3.43.0-01 and prior Nexus Repository 3 version 3.44.0-01 and prior Nexus Repository 3 version 3.45.0-01 and prior Nexus Repository 3 version 3.46.0-01 and prior Nexus Repository 3 version 3.47.0-01 and prior Nexus Repository 3 version 3.48.0-01 and prior Nexus Repository 3 version 3.49.0-01 and prior Nexus Repository 3 version 3.50.0-01 and prior Nexus Repository 3 version 3.51.0-01 and prior Nexus Repository 3 version 3.52.0-01 and prior Nexus Repository 3 version 3.53.0-01 and prior Nexus Repository 3 version 3.54.0-01 and prior Nexus Repository 3 version 3.55.0-01 and prior Nexus Repository 3 version 3.56.0-01 and prior Nexus Repository 3 version 3.57.0-01 and prior Nexus Repository 3 version 3.58.0-01 and prior Nexus Repository 3 version 3.59.0-01 and prior Nexus Repository 3 version 3.60.0-01 and prior Nexus Repository 3 version 3.61.0-01 and prior Nexus Repository 3 version 3.62.0-01 and prior Nexus Repository 3 version 3.63.0-01 and prior Nexus Repository 3 version 3.64.0-01 and prior Nexus Repository 3 version 3.65.0-01 and prior Nexus Repository 3 version 3.66.0-01 and prior Nexus Repository 3 version 3.67.0-01 and prior Nexus Repository 3 version 3.68.0-01 and prior Nexus Repository 3 version 3.69.0-01 and prior Nexus Repository 3 version 3.70.0-01 and prior Nexus Repository 3 version 3.71.0-01 and prior Nexus Repository 3 version 3.72.0-01 and prior Nexus Repository 3 version 3.73.0-01 and prior Nexus Repository 3 version 3.74.0-01 and prior Nexus Repository 3 version 3.75.0-01 and prior Nexus Repository 3 version 3.76.0-01 and prior Nexus Repository 3 version 3.77.0-01 and prior Nexus Repository 3 version 3.78.0-01 and prior Nexus Repository 3 version 3.79.0-01 and prior Nexus Repository 3 version 3.80.0-01 and prior Nexus Repository 3 version 3.81.0-01 and prior Nexus Repository 3 version 3.82.0-01 and prior Nexus Repository 3 version 3.83.0-01 and prior Nexus Repository 3 version 3.84.0-01 and prior Nexus Repository 3 version 3.85.0-01 and prior Nexus Repository 3 version 3.86.0-01 and prior Nexus Repository 3 version 3.87.0-01 and prior Nexus Repository 3 version 3.88.0-01 and prior Nexus Repository 3 version 3.89.0-01 and prior Nexus Repository 3 version 3.90.0-01 and prior Nexus Repository 3 version 3.91.0-01 and prior Nexus Repository 3 version 3.92.0-01 and prior Nexus Repository 3 version 3.93.0-01 and prior Nexus Repository 3 version 3.94.0-01 and prior Nexus Repository 3 version 3.95.0-01 and prior Nexus Repository 3 version 3.96.0-01 and prior Nexus Repository 3 version 3.97.0-01 and prior Nexus Repository 3 version 3.98.0-01 and prior Nexus Repository 3 version 3.99.0-01 and prior Nexus Repository 3 version 3.100.0-01 and prior Nexus Repository 3 version 3.101.0-01 and prior Nexus Repository 3 version 3.102.0-01 and prior Nexus Repository 3 version 3.103.0-01 and prior Nexus Repository 3 version 3.104.0-01 and prior Nexus Repository 3 version 3.105.0-01 and prior Nexus Repository 3 version 3.106.0-01 and prior Nexus Repository 3 version 3.107.0-01 and prior Nexus Repository 3 version 3.108.0-01 and prior Nexus Repository 3 version 3.109.0-01 and prior Nexus Repository 3 version 3.110.0-01 and prior Nexus Repository 3 version 3.111.0-01 and prior Nexus Repository 3 version 3.112.0-01 and prior Nexus Repository 3 version 3.113.0-01 and prior Nexus Repository 3 version 3.114.0-01 and prior Nexus Repository 3 version 3.115.0-01 and prior

Goal Reached Thanks to every supporter — we hit 100%!

Nexus Repository 3 JEXL Sandbox Property-Read Bypass (CVE-2020-17095) Advisory