Sonatype Nexus Repository Manager 3 up to and including 3.21.1 is vulnerable to Expression Language injection. An attacker authenticated with an administrative account can inject an EL expression into the user "roles" field of the coreui_User update endpoint, leading to remote code execution. This is a bypass of the fix for CVE-2018-16621.
登录后查看神龙缓存的 POC 文件快照
登录查看