Yousif

**Name of the Vulnerable Software and Affected Versions** Sonatype Nexus Repository 3 (affected versions not specified) **Description** An authorization flaw exists in the REST API repository details endpoint 'GET /service/rest/v1/repositories/{repositoryName}'. An account with read or browse permissions on a group repository can retrieve metadata for member repositories without having direct permissions for them by requesting the endpoint using the `repositoryName` variable. In the case of proxy repositories, the exposed metadata includes the configured remote URL, which could reveal internal upstream hostnames. This issue also affects anonymous users if they have been granted the necessary permissions based on the installation's role and permission configuration. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Nexus Repository 3 (affected versions not specified) **Description** An authorization bypass exists in the script execution endpoint 'POST /service/rest/v1/script/{name}/run'. The system fails to verify if script execution has been administratively disabled. Consequently, an account with script-execution permissions can execute previously created scripts even after the `nexus.scripts.allowCreation` variable is set to `false`, bypassing the intended administrative restriction. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Nexus Repository 3 versions prior to 3.95.0 **Description** Stored cross-site scripting (XSS) occurs when a user with `nexus:blobstores:create` or `nexus:blobstores:update` permissions sets a blob store name containing malicious script content. This script executes in the browser of another user when they view the system health-check status. **Recommendations** Update to version 3.95.0.