CVE-2024-5764

Name of the Vulnerable Software and Affected Versions: Sonatype Nexus Repository versions 3.0.0 through 3.72.0

Description: A Use of Hard-coded Credentials vulnerability has been discovered in the code responsible for encrypting secrets stored in the Nexus Repository configuration database, such as SMTP or HTTP proxy credentials and user tokens. The affected versions relied on a static hard-coded encryption passphrase, which could only be altered at first boot and not updated.

Recommendations: For Sonatype Nexus Repository versions 3.0.0 through 3.72.0, update the encryption passphrase as soon as possible to prevent exploitation. As a temporary workaround, consider restricting access to sensitive areas of the Nexus Repository configuration database until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.