High
Security advisory
Sonatype Nexus Repository Manager before 3.14 allows Java Expression Language Injection.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2018-16621
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:10 UTC · Revision 1
Source evidence
Sonatype Nexus Repository Manager before 3.14 allows Java Expression Language Injection.
osv:CVE-2018-16621
Complete source record
{
"id": "db019490bcd155f40f770363902903cb5ccb235c3383da802e95194ab48aeed2",
"url": "https://osv.dev/vulnerability/CVE-2018-16621",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2018-16621",
"summary": "Sonatype Nexus Repository Manager before 3.14 allows Java Expression Language Injection.",
"evidence": "osv:CVE-2018-16621",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2018-16621",
"aliases": [
"CVE-2018-16621"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/sonatype/nexus-public",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "126fcdfbc07b53780743bc9d341adfad89cd7644"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:sonatype:nexus_repository_manager:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "3.14.0"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"release-3.5.0-02",
"release-3.4.0-02",
"release-3.3.0-01"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-16621.json",
"vanir_signatures": [
{
"id": "CVE-2018-16621-0bfd12dd",
"digest": {
"threshold": 0.9,
"line_hashes": [
"131254317602757598120702857576990746922",
"159768258589938651516011611439960824813",
"329985976634456647798039711601683660797",
"299594850922542493398204442710269655262",
"47861878466544182721139794977505735920",
"120635752493946831904284429546138769825",
"99616599555257976797990065267672813096",
"192548977146886621095957306059214676055",
"276188802380308302753162303464644399564",
"33515447592422026359645688768105462115",
"141408625760726267741898725815622128468",
"19720554419864696248917648812705687158",
"48766538321210394219841321505544611085",
"320918079708753836690930009446594829503",
"165688494212133982932174848364621938789",
"312788306784604830029897499827024509944",
"47574553508887439049034181778715521804",
"166041955448993678757109578085071354150",
"58705515812013967777576273978778995073",
"135658837881278321451909889525521664254",
"88479056960241591719171284551420912890",
"113346445619806136734337765028677145852",
"216055982323762466315348454797998363831",
"236264491971290681460362015198412663670",
"75993947298123902397180542514181968392",
"26308711505422718880291165418420853636",
"73228030438053056830203080150049675464",
"32157067225520346666868335740453470864",
"254961303405962620478165131941011725590"
]
},
"source": "https://github.com/sonatype/nexus-public/commit/126fcdfbc07b53780743bc9d341adfad89cd7644",
"target": {
"file": "plugins/nexus-blobstore-tasks/src/main/java/org/sonatype/nexus/blobstore/restore/BaseRestoreBlobStrategy.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2018-16621-0eedbf1a",
"digest": {
"length": 77,
"function_hash": "160791396788551521793895612221819884539"
},
"source": "https://github.com/sonatype/nexus-public/commit/126fcdfbc07b53780743bc9d341adfad89cd7644",
"target": {
"file": "components/nexus-formfields/src/main/java/org/sonatype/nexus/formfields/CheckboxFormField.java",
"function": "withInputValue"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2018-16621-12e17eb3",
"digest": {
"threshold": 0.9,
"line_hashes": [
"319687027807079032258896528549610838063",
"18686308714158725923406624887931575779",
"326367732329999535882927481565096148199",
"143909030522247254716638657661183367564",
"253345460308326473723366717304642006597",
"329091412005853586452680337978816562307",
"157757494872627796571947669159009965009",
"269037371949973007115291372427031567561",
"63427740959334779682750098631271731508",
"311434602281952302763251987462824210123",
"18030329193613537612025326632431086384"
]
},
"source": "https://github.com/sonatype/nexus-public/commit/126fcdfbc07b53780743bc9d341adfad89cd7644",
"target": {
"file": "plugins/nexus-repository-maven/src/main/java/org/sonatype/nexus/repository/maven/internal/hosted/MavenHostedFacetImpl.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2018-16621-1e2ba06d",
"digest": {
"length": 201,
"function_hash": "208014533124381839054952557366803805082"
},
"source": "https://github.com/sonatype/nexus-public/commit/126fcdfbc07b53780743bc9d341adfad89cd7644",
"target": {
"file": "plugins/nexus-repository-pypi/src/main/java/org/sonatype/nexus/repository/pypi/internal/PyPiHostedFacetImpl.java",
"function": "mayAddEtag"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2018-16621-1faf0a59",
"digest": {
"threshold": 0.9,
"line_hashes": [
"92056114222030344247645703819014349008",
"300299954620649926588339915939198389465",
"142242221029900499364553467015996619891",
"275817214947335253431594284331085470619",
"311724369874780557230294611016422361889",
"220806663509251627303776820665206277480",
"208212980619149770717835270996555166611",
"162804206003406453418761680284168932429",
"169061957599462939646879478920606942379",
"271961028583430971612897975670518090405",
"9070173987402223259935857456793247743",
"262881144700743829964358025297007599040",
"274802998771839329987632372518602401757",
"40114083219488978042340797127748314910"
]
},
"source": "https://github.com/sonatype/nexus-public/commit/126fcdfbc07b53780743bc9d341adfad89cd7644",
"target": {
"file": "components/nexus-formfields/src/main/java/org/sonatype/nexus/formfields/CheckboxFormField.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2018-16621-1fc370bd",
"digest": {
"threshold": 0.9,
"line_hashes": [
"316308757928637051892038064156923874999",
"155213501554895721331203756004274821638",
"41256353444688726660647130714415916874",
"245805580135691741665351329992983711295",
"251961135684681141333756107820717776354",
"33811831478709133962175413223445724570",
"157645989610132357701040890375936736544",
"129149497077507302040540053482707175709",
"263510767540859184695375030623894198065",
"109694216641166092273190197666801643772",
"164489755374694039055587184213325382655",
"334877877254308364312918909819763731549"
]
},
"source": "https://github.com/sonatype/nexus-public/commit/126fcdfbc07b53780743bc9d341adfad89cd7644",
"target": {
"file": "components/nexus-repository/src/main/java/org/sonatype/nexus/repository/storage/DefaultComponentMaintenanceImpl.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2018-16621-23d9a24c",
"digest": {
"length": 275,
"function_hash": "13973410519284741786910210377701764485"
},
"source": "https://github.com/sonatype/nexus-public/commit/126fcdfbc07b53780743bc9d341adfad89cd7644",
"target": {
"file": "plugins/nexus-repository-maven/src/main/java/org/sonatype/nexus/repository/maven/internal/MavenFacetUtils.java",
"function": "getPathWithHashes"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2018-16621-2d6a30ff",
"digest": {
"threshold": 0.9,
"line_hashes": [
"135337850869547448636859887633348994979",
"256338766379828195646435435073092020462",
"224517867254953282084590984747187980098",
"123824848147878247536968146485238712368"
]
},
"source": "https://github.com/sonatype/nexus-public/commit/126fcdfbc07b53780743bc9d341adfad89cd7644",
"target": {
"file": "components/nexus-repository/src/main/java/org/sonatype/nexus/repository/internal/blobstore/BlobStoreConfigurationStoreImpl.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2018-16621-3f2e0636",
"digest": {
"length": 376,
"function_hash": "321681422393377074790636673119504242218"
},
"source": "https://github.com/sonatype/nexus-public/commit/126fcdfbc07b53780743bc9d341adfad89cd7644",
"target": {
"file": "plugins/nexus-blobstore-tasks/src/main/java/org/sonatype/nexus/blobstore/restore/BaseRestoreBlobStrategy.java",
"function": "doCreateAssetFromBlob"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2018-16621-4242b379",
"digest": {
"length": 126,
"function_hash": "189378976441500947273591388326809910830"
},
"source": "https://github.com/sonatype/nexus-public/commit/126fcdfbc07b53780743bc9d341adfad89cd7644",
"target": {
"file": "components/nexus-repository/src/main/java/org/sonatype/nexus/repository/browse/internal/BrowseNodeEventHandler.java",
"function": "on"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2018-16621-45b0e3ec",
"digest": {
"length": 126,
"function_hash": "189378976441500947273591388326809910830"
},
"source": "https://github.com/sonatype/nexus-public/commit/126fcdfbc07b53780743bc9d341adfad89cd7644",
"target": {
"file": "components/nexus-repository/src/main/java/org/sonatype/nexus/repository/browse/internal/BrowseNodeEventHandler.java",
"function": "on"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2018-16621-47f76ff6",
"digest": {
"length": 91,
"function_hash": "190067122155390850705553918780856772960"
},
"source": "https://github.com/sonatype/nexus-public/commit/126fcdfbc07b53780743bc9d341adfad89cd7644",
"target": {
"file": "components/nexus-repository/src/main/java/org/sonatype/nexus/repository/browse/internal/BrowseNodeEventHandler.java",
"function": "shouldProcess"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2018-16621-636aa869",
"digest": {
"threshold": 0.9,
"line_hashes": [
"163016593340681771683874797699482639860",
"215010159284852028531072480729932397202",
"154042501463185971474342826995295742024",
"230786195780030882944996293080767655415",
"57673646389272918062146041684816899818",
"39742687115551388482846063119392958533",
"182363588226813388697637039419340178689",
"227529817165385515263759874847493035724",
"169214827026752685015216995966362598886",
"67823431233561974680149522207553225986",
"309911344997761097275608751991301702862",
"63701284587406714653285845735298899799",
"139544904473347710118549314506182761442",
"77057211282681316655610779402875623229",
"198154502931506446294861555206800495257",
"293085683081728299502396456739843585595",
"271990379873012101264174284374633566734",
"102737042150099035175431393340179130671",
"307610694368485434398126388820056819439",
"308332427682258343142159603199127428878",
"284525510077574963749932112827823244519",
"176338205797041956188449027420204895831",
"266025208315123015300087767899320328232",
"252942054963679998575051275805378594316",
"101579627443423557937578232553287239961",
"135136800569309945767155624465239726013",
"230405861904904053338895093431469483899",
"149424301220391546200241579459627917167",
"236748406055785725277272144744807417096",
"226732823919343477115776786356576846870",
"281324666677791070859126540877504881335",
"164923063948833233106327161669032692068",
"53517408595400005554901584365485919227",
"172830465199203721793661394535740950191",
"32125711241628669542389093510494348742",
"233190709232265664920942260934941219170",
"334195993711664007449600569939595363316",
"294029553210394580253543359440008260155",
"23931086556606337171795133380318975807",
"217180732983670830561368893480595804273",
"126448703664104581346708345005966372091",
"257344545392431317664569794857118518756",
"252941206873161459508534321418599357449",
"331419068813473134622110298827758604050",
"191730356318630202767073443183307285038",
"110327650146231920766750948914202751811",
"140878057376008128439201739045069430641",
"109245329615908835224129749875575775230",
"52227669343565308149441650773476607332",
"311685377220578256657852711181028472170",
"50395338292792375319131145565476022540"
]
},
"source": "https://github.com/sonatype/nexus-public/commit/126fcdfbc07b53780743bc9d341adfad89cd7644",
"target": {
"file": "plugins/nexus-coreui-plugin/src/main/java/org/sonatype/nexus/coreui/internal/search/KeywordSearchContribution.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2018-16621-6432984e",
"digest": {
"threshold": 0.9,
"line_hashes": [
"186125974623864021743885363333673808120",
"229416467796586385479159411890444405953",
"291675438657663885763874156988224476111",
"278394619864818635131808147482795029478",
"310567680272543685706516775341140594861"
]
},
"source": "https://github.com/sonatype/nexus-public/commit/126fcdfbc07b53780743bc9d341adfad89cd7644",
"target": {
"file": "components/nexus-repository/src/main/java/org/sonatype/nexus/repository/storage/ComponentMaintenance.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2018-16621-76f86de3",
"digest": {
"length": 492,
"function_hash": "338185922435603637345605280049383474068"
},
"source": "https://github.com/sonatype/nexus-public/commit/126fcdfbc07b53780743bc9d341adfad89cd7644",
"target": {
"file": "plugins/nexus-repository-maven/src/test/java/org/sonatype/nexus/repository/maven/internal/MavenFacetUtilsTest.java",
"function": "testGetPathWithHashes"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2018-16621-81aebf7b",
"digest": {
"threshold": 0.9,
"line_hashes": [
"242964413612711133400441394779615290123",
"204384969209238632514755641305217584363",
"195209661633048650705908815716984991706",
"199600081913872701150286043129482917797"
]
},
"source": "https://github.com/sonatype/nexus-public/commit/126fcdfbc07b53780743bc9d341adfad89cd7644",
"target": {
"file": "components/nexus-repository/src/main/java/org/sonatype/nexus/repository/internal/blobstore/BlobStoreManagerImpl.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2018-16621-83039ee2",
"digest": {
"threshold": 0.9,
"line_hashes": [
"204888082440247716181457646713432206215",
"79427057445985233627427531683358758175"
]
},
"source": "https://github.com/sonatype/nexus-public/commit/126fcdfbc07b53780743bc9d341adfad89cd7644",
"target": {
"file": "components/nexus-repository/src/main/java/org/sonatype/nexus/repository/maintenance/MaintenanceService.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2018-16621-848854aa",
"digest": {
"length": 476,
"function_hash": "47842656316484631336712811036740584556"
},
"source": "https://github.com/sonatype/nexus-public/commit/126fcdfbc07b53780743bc9d341adfad89cd7644",
"target": {
"file": "plugins/nexus-repository-maven/src/main/java/org/sonatype/nexus/repository/maven/internal/hosted/metadata/MetadataRebuilder.java",
"function": "rebuild"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2018-16621-9192a63e",
"digest": {
"length": 1084,
"function_hash": "285638542861318337033798203363643385974"
},
"source": "https://github.com/sonatype/nexus-public/commit/126fcdfbc07b53780743bc9d341adfad89cd7644",
"target": {
"file": "plugins/nexus-coreui-plugin/src/main/java/org/sonatype/nexus/coreui/internal/search/KeywordSearchContribution.java",
"function": "contribute"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2018-16621-99563f52",
"digest": {
"threshold": 0.9,
"line_hashes": [
"273998193731924059266566513815018525473",
"57716108334750603290184863271078611059",
"48761493719436581242789725723785993769",
"223528888536498672261750781687566537974",
"39423466637388206387272477197778219725",
"317236437539364849305407491857886434903",
"339185368883777684724732645973214724802",
"177889264726323179422661572797749892115"
]
},
"source": "https://github.com/sonatype/nexus-public/commit/126fcdfbc07b53780743bc9d341adfad89cd7644",
"target": {
"file": "components/nexus-repository/src/main/java/org/sonatype/nexus/repository/maintenance/internal/MaintenanceServiceImpl.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2018-16621-9e0d0c29",
"digest": {
"length": 149,
"function_hash": "197420288431981259350683181693036445391"
},
"source": "https://github.com/sonatype/nexus-public/commit/126fcdfbc07b53780743bc9d341adfad89cd7644",
"target": {
"file": "components/nexus-repository/src/main/java/org/sonatype/nexus/repository/browse/internal/BrowseNodeEventHandler.java",
"function": "on"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2018-16621-a12c1882",
"digest": {
"threshold": 0.9,
"line_hashes": [
"55838998439212964768784730778357003852",
"254337272916603740892306870009539999007",
"288627079234958858641691072332881731980",
"262959116676946315289312375722008829780",
"272544409924608208010741434790892909068",
"224861317230550031007776754439717827967",
"305061267574910111232253399967715904288",
"298740209658763262471328879519814131309",
"47115587542313055057466211898851709361",
"304899967338753389480945678257957844341",
"221365435718412100463713113886240416789",
"5441548143371776241106037636112923621",
"178135256640971204746471664840163607482",
"193593695324368026652032646042078672676",
"212868907801030850504686050491712548969",
"134326528467049572540636927067030079087",
"60966504482455017775442183630693323612",
"104597797585966727575346192216241903887",
"148840571146580923681046047311185098430",
"314063655985630359754412051896694925936",
"146191941426899042613448794963029276121",
"170376751998845217408912090421742061681",
"73238813828677590830335149028917174996",
"36668722100056791832804643097054949232",
"104597797585966727575346192216241903887",
"127035719713870742721507937115490103231",
"228582460318672000437666982720008699243",
"105046804043837269228807915762732139887",
"320469759299956231773139407085598014478",
"296210713167442012239526115349187504071",
"289513925453944456076003014931909137045",
"104597797585966727575346192216241903887",
"146453676204322559645476277690607898357",
"101879442507448783813022844510075017428",
"300259839511451088282052670765695706480",
"66257338213343536936903223766034570290",
"196525209617629806090104839728795386472",
"210511575804035962023483007510324732948",
"30831226038916478962206454602161309274",
"59451396908631317371013975660341067186",
"114802176958692877876245379198815712856",
"44112378029761234161750530670225826065"
]
},
"source": "https://github.com/sonatype/nexus-public/commit/126fcdfbc07b53780743bc9d341adfad89cd7644",
"target": {
"file": "components/nexus-repository/src/main/java/org/sonatype/nexus/repository/browse/internal/BrowseNodeEventHandler.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2018-16621-b3783ccf",
"digest": {
"length": 1230,
"function_hash": "298222701637762626214135778961203694574"
},
"source": "https://github.com/sonatype/nexus-public/commit/126fcdfbc07b53780743bc9d341adfad89cd7644",
"target": {
"file": "plugins/nexus-repository-maven/src/main/java/org/sonatype/nexus/repository/maven/internal/hosted/metadata/MetadataRebuilder.java",
"function": "deleteAndRebuild"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2018-16621-b7267627",
"digest": {
"threshold": 0.9,
"line_hashes": [
"22278181505065414854677788064588804427",
"339767951248908807995618429979884076250",
"280621842946193016658513221009621672987",
"235648704013101605151985322067779918835",
"76628856019012434286540865621481030336",
"17194771939212700049604301037876841528",
"226449058774979663541896341914128874852",
"307717367857774606529387859589622304261",
"17197658067272491504652511199395310398",
"208035801751424381715530162789203751578",
"307912448743624477348927863437507943018",
"59563253512198026918836059778375452287",
"307118627156065893507603891285400693302",
"123882646229732243899188376783794958258",
"100830255947081955974388853953707513220",
"116907124372936620558335606132654655708",
"1939138259797026207616335528679820183",
"60340820518321229363713436424888945971",
"5557785007587279185626164945323175956",
"317350631353838743797278558928209822274",
"75828296424809351498818767838380798451",
"11809149155302465827684021711455708211",
"117296265670514517983208152187982200984",
"73605919055702990467916774062383421645",
"98179968383984990709834139213340226495",
"245191921499990800450221580584851469888",
"166012698544140416312615171508632990829",
"214941417255885120967696879840226215351",
"172652066622981658518722190641249926534",
"211407190842874536572213202295512151605",
"325765299090765789406167633175558077576",
"286803960911386782168735537412447638514",
"170667539662062765374764118746091039766"
]
},
"source": "https://github.com/sonatype/nexus-public/commit/126fcdfbc07b53780743bc9d341adfad89cd7644",
"target": {
"file": "plugins/nexus-repository-maven/src/test/java/org/sonatype/nexus/repository/maven/internal/MavenFacetUtilsTest.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2018-16621-c02f023e",
"digest": {
"length": 564,
"function_hash": "188405678766064621465379863573394943914"
},
"source": "https://github.com/sonatype/nexus-public/commit/126fcdfbc07b53780743bc9d341adfad89cd7644",
"target": {
"file": "components/nexus-repository/src/main/java/org/sonatype/nexus/repository/maintenance/internal/MaintenanceServiceImpl.java",
"function": "deleteComponent"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2018-16621-c9186690",
"digest": {
"threshold": 0.9,
"line_hashes": [
"194840176299351117355856193592459343637",
"124138021284474952414914153243734392891",
"1210712695510081676312846588140095170",
"205206902673528247387546750365040024587",
"306298381261042722442609340624055029172",
"208701852340052335688323029275241819917",
"309184594683962181369622623890684972946",
"134024613452872509070739549551505375476",
"89432639052704665105680152601891472216",
"15941008711159967164137333429052998284",
"54760200272050955060677743516440546183",
"89393160199023412341309399985299849993",
"141076591336073291829479661273809708778",
"218604181620294196170474828438850743597",
"232723525118138109491024080461081500320",
"219365605090934254101370772876140515140",
"122197632198662773766671932828321046",
"186620610955595008003752837145781906029"
]
},
"source": "https://github.com/sonatype/nexus-public/commit/126fcdfbc07b53780743bc9d341adfad89cd7644",
"target": {
"file": "plugins/nexus-repository-maven/src/main/java/org/sonatype/nexus/repository/maven/internal/hosted/MavenHostedComponentMaintenanceFacet.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2018-16621-ca91ed56",
"digest": {
"length": 42,
"function_hash": "109292893723283190180479228418553213757"
},
"source": "https://github.com/sonatype/nexus-public/commit/126fcdfbc07b53780743bc9d341adfad89cd7644",
"target": {
"file": "components/nexus-formfields/src/main/java/org/sonatype/nexus/formfields/CheckboxFormField.java",
"function": "getInputValue"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2018-16621-cb15debc",
"digest": {
"length": 612,
"function_hash": "153785371296426955611290702533325966923"
},
"source": "https://github.com/sonatype/nexus-public/commit/126fcdfbc07b53780743bc9d341adfad89cd7644",
"target": {
"file": "plugins/nexus-repository-maven/src/main/java/org/sonatype/nexus/repository/maven/internal/hosted/metadata/MetadataRebuilder.java",
"function": "rebuildMetadata"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2018-16621-d4e13761",
"digest": {
"threshold": 0.9,
"line_hashes": [
"189610746543279577125288418995931545799",
"133087981905806806988122753191779728083",
"52184608996340289613512812077871200217",
"77481334816798246786874196081829688272",
"111927414587109909994067653268342980713",
"224878226662118260735243041757568097323",
"260232871925521910542254345774760111965"
]
},
"source": "https://github.com/sonatype/nexus-public/commit/126fcdfbc07b53780743bc9d341adfad89cd7644",
"target": {
"file": "plugins/nexus-repository-maven/src/main/java/org/sonatype/nexus/repository/maven/MavenHostedFacet.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2018-16621-d698c803",
"digest": {
"length": 313,
"function_hash": "326331194180888820556641949417462802608"
},
"source": "https://github.com/sonatype/nexus-public/commit/126fcdfbc07b53780743bc9d341adfad89cd7644",
"target": {
"file": "plugins/nexus-repository-maven/src/main/java/org/sonatype/nexus/repository/maven/internal/hosted/MavenHostedFacetImpl.java",
"function": "deleteMetadata"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2018-16621-e056e679",
"digest": {
"length": 463,
"function_hash": "120212083017034909428510219176765604619"
},
"source": "https://github.com/sonatype/nexus-public/commit/126fcdfbc07b53780743bc9d341adfad89cd7644",
"target": {
"file": "plugins/nexus-repository-maven/src/main/java/org/sonatype/nexus/repository/maven/internal/hosted/MavenHostedComponentMaintenanceFacet.java",
"function": "deleteComponent"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2018-16621-e0935065",
"digest": {
"length": 1037,
"function_hash": "153879356864626444113909429766591753678"
},
"source": "https://github.com/sonatype/nexus-public/commit/126fcdfbc07b53780743bc9d341adfad89cd7644",
"target": {
"file": "plugins/nexus-blobstore-tasks/src/main/java/org/sonatype/nexus/blobstore/restore/BaseRestoreBlobStrategy.java",
"function": "doRestore"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2018-16621-e9585d7d",
"digest": {
"threshold": 0.9,
"line_hashes": [
"156233580612291847675173539414628612244",
"111442738712459985778388228447515110349",
"163193992802835521350643549808705414096",
"279118738397569944925485559297762383710",
"99147044186195942447564822471695373487",
"222880199597085562262824894816856672442",
"79377627745671899418121943536235233733",
"218504086107751538996267095447123983805",
"207322966645329330558949776422546739793",
"131995421529928674786962983768608719745",
"210238334708146151574330706421689003495",
"193363923912469745813950241226708133878",
"116915598191312096559562372872071733565",
"325785813663143528550299433842588766027",
"234155124822173412372783152747070448786",
"185256552183236334603112248355434706928"
]
},
"source": "https://github.com/sonatype/nexus-public/commit/126fcdfbc07b53780743bc9d341adfad89cd7644",
"target": {
"file": "plugins/nexus-repository-maven/src/main/java/org/sonatype/nexus/repository/maven/internal/MavenFacetUtils.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2018-16621-eb3a0585",
"digest": {
"threshold": 0.9,
"line_hashes": [
"175285654780531959659040110434128370561",
"59077964406132334155376920256129640168",
"52376388894563909207185886232534020056",
"305693372372640921994107121242300589783",
"58344016874633271798776413987093179561",
"127816132597855687902218267441959713486",
"151284361294551967855884925156794393531",
"221467460782964594323174125673044503999",
"177384122158782241713106693567525410187",
"225404567189020497195246266357213357445",
"160597553348750980146720613179218181286",
"325330699768574390266585359245630484801",
"113299763553282677360262618290911786297",
"66939538105413217973478822792817791581",
"214884193768493186103472540795022413495",
"178258550952135421362244296435224399412",
"335396377610538199293264225592700227056",
"246665375153167241939504435284513061815",
"144997377924999328569420807991883506403",
"311808903513314308041849042800344064345",
"43933988648611512619420220477173878681",
"56899101833729938165206157873428731411",
"148977762703821899250986847361878312151"
]
},
"source": "https://github.com/sonatype/nexus-public/commit/126fcdfbc07b53780743bc9d341adfad89cd7644",
"target": {
"file": "plugins/nexus-repository-pypi/src/main/java/org/sonatype/nexus/repository/pypi/internal/PyPiHostedFacetImpl.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2018-16621-ee83c850",
"digest": {
"threshold": 0.9,
"line_hashes": [
"209130157030305553653246883855101211089",
"276348862064232433161342906387577717444",
"13286806436020859150303320551932374615",
"142503456107572047932249335831253256153",
"17462235622183067077932280396494656125",
"135052683284686789545272745505129387215",
"67811704747425512794889344094169313450",
"190492433067384901144100361028773644910",
"151971323898473853233466483769790487951",
"339229489489292343090895198645875010780",
"31420179315641113344373818226831188732",
"282807687283461102109112610083517666987",
"313016618667744356715907120927854274956",
"65722266163999505124834092544496706229",
"327324299567246970075296929943256822860",
"45654607997670880367634058290864979714",
"319850303972893735528969295929046985186",
"337425418724804859397026481925259542127",
"172896099345231290814933735999310996049",
"139459661752775469663120173569698936937",
"24683232409666614676589360726465103782",
"232389017746227602065406311045389512289",
"284911497813458468876054664692198512447",
"309818528461593697024930764138720761356",
"234848664870429717503504453179945276853",
"85755211044241527424485320921104190264",
"314450559562147765891725927944567974248",
"93168373770486133194920417769537172396",
"339823406724830803654769542108150045275",
"29405990615097195827596016276582166681",
"314358637666674018894717086746142768949",
"162495652141633858051392917917975695669",
"250135454507242599773666951910209399844",
"277047107140611638672711416053640652521",
"327842814626229956824934103653728279038",
"302225006256860594253573457627931346775",
"338427164979083198368469325222766999819",
"185618039701723148713942751699976419336",
"138870555108767996982135434996729179186",
"76785764698737408702292709816606870780",
"179354281395221254623977142740584564736",
"216003013667850463536827083355407111574",
"158487906805083000158490422179807047092",
"132429101179234516645708774469840728067",
"179268097244739793662519981150624093911",
"101427564131721014049996653063333873032",
"294861084950242638345754230495121351807",
"129480864772896365526116902332990368405",
"301550251355574439044697060621192898069",
"294451906815324655674133611153791769669",
"333509190994896371617934677190578679381",
"258878214637465724173903196686756800497",
"165426478222844992963375840088315715605",
"4264692085498655346325656967557355513",
"110706891544519877455140469134507335390",
"222037064620977843856573279417916475273",
"312926079706306182888025505045787824467",
"91713997772673532678230027263105649000",
"192552696451177805830179496388308842393",
"329006309102702369536630431798197644049",
"245329219777450569529864002952456539014",
"155225951444215791398185633354824645378",
"192934344126755204426031999296994024917",
"14002697455656460803346336590656590559",
"207944437686498820953879238138191241670"
]
},
"source": "https://github.com/sonatype/nexus-public/commit/126fcdfbc07b53780743bc9d341adfad89cd7644",
"target": {
"file": "plugins/nexus-repository-maven/src/main/java/org/sonatype/nexus/repository/maven/internal/hosted/metadata/MetadataRebuilder.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2018-16621-f33e58ab",
"digest": {
"length": 126,
"function_hash": "189378976441500947273591388326809910830"
},
"source": "https://github.com/sonatype/nexus-public/commit/126fcdfbc07b53780743bc9d341adfad89cd7644",
"target": {
"file": "components/nexus-repository/src/main/java/org/sonatype/nexus/repository/browse/internal/BrowseNodeEventHandler.java",
"function": "on"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2018-16621-fc4a5051",
"digest": {
"length": 426,
"function_hash": "332284495276273047152622926501949612665"
},
"source": "https://github.com/sonatype/nexus-public/commit/126fcdfbc07b53780743bc9d341adfad89cd7644",
"target": {
"file": "plugins/nexus-repository-pypi/src/main/java/org/sonatype/nexus/repository/pypi/internal/PyPiHostedFacetImpl.java",
"function": "getPackage"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-24T14:11:08Z"
}
}
],
"modified": "2026-10-24T14:11:08.957759444Z",
"provider": "osv",
"references": [
"https://support.sonatype.com/hc/en-us/articles/360010789153-CVE-2018-16621-Nexus-Repository-Manager-Java-Injection-October-17-2018",
"https://securitylab.github.com/advisories/GHSL-2020-015-nxrm-sonatype"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2018-16621",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 443225,
"published_at": "2018-11-15T20:29:00.38+00:00"
}