CVE-2020-29436: 
Sonatype Nexus 3 vulnerability analysis and mitigation

An XML External Entities (XXE) injection vulnerability was discovered in Sonatype Nexus Repository Manager 3.x before version 3.29.0, identified as CVE-2020-29436. The vulnerability was disclosed on December 15th, 2020, affecting all Nexus Repository 3 OSS/Pro versions up to and including 3.28.1, as well as IQ Server from release 74 up to and including release 101 (Vendor Advisory).

The vulnerability is classified as an XML External Entities (XXE) injection with a CVSS v3.1 Base Score of 8.7 (Critical) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H. The issue stems from improper restriction of XML External Entity references (CWE-611). The vulnerability allows XML parsing library to process external entities, which could be exploited by an attacker with administrative privileges (NVD, Vendor Advisory).

If exploited, the vulnerability allows an attacker to view files on the filesystem and interact with any back-end or external systems that Nexus Repository 3 can access. The attacker could potentially read and modify any content on the system that the Nexus Repository 3 server has access to (Vendor Advisory).

The vulnerability requires an attacker to have administrative-level user account access in the Nexus Repository 3 instance to configure the system in a vulnerable manner. At the time of disclosure, there were no known active exploits taking advantage of this vulnerability (Vendor Advisory).

The vulnerability was fixed in Nexus Repository OSS/Pro version 3.29.0 and IQ Server release 102. Sonatype strongly recommends upgrading to these versions or later. The fix involves preventing the XML parsing library from processing external entities. The latest version can be downloaded from the official Sonatype website (Vendor Advisory).

The vulnerability was discovered and reported by James Mills at F-Secure Consulting. Sonatype took a proactive approach in their outreach activities to achieve rapid remediation, acknowledging that disclosure could potentially lead to exploitation attempts by malicious actors (Vendor Advisory).