CVE-2020-10203: 
Java vulnerability analysis and mitigation

A cross-site scripting (XSS) vulnerability was discovered in Sonatype Nexus Repository 3 (CVE-2020-10203), affecting all versions up to and including 3.21.1. The vulnerability was disclosed on March 31, 2020, and was discovered by Github Security Lab team member pwntester (Alvaro Muñoz) (Sonatype Advisory).

The vulnerability received a Critical CVSS v3.1 score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). The issue allows attackers with elevated privileges to create entities with specially crafted properties which, when viewed by another user, can execute arbitrary JavaScript in the context of the Nexus Repository application (Sonatype Advisory).

When exploited, the vulnerability allows arbitrary JavaScript to run in a Nexus Repository user's browser in the context of the application. The injected JavaScript could potentially forge requests on behalf of the user, redirect the user to another site, or modify the page content, leading to compromise of the confidentiality and integrity of data (Sonatype Advisory).

The vulnerability was fixed in Nexus Repository OSS/Pro version 3.21.2 by ensuring the values are properly encoded. Sonatype strongly recommended all affected instances of Nexus Repository 3 be upgraded to version 3.21.2 or later (Sonatype Advisory).