Nexus Repository Manager Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2018-5306 - Vulnerability Database

Nexus Repository Manager Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2018-5306

Medium

Reference: CVE-2018-5306

NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2018-5306

Title: Nexus Repository Manager Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability

Overview:

Multiple cross-site scripting (XSS) vulnerabilities in Sonatype Nexus Repository Manager (aka NXRM) 3.x before 3.8 allow remote attackers to inject arbitrary web script or HTML via (1) the repoId or (2) format parameter to service/siesta/healthcheck/healthCheckFileDetail/.../index.html (3) the filename in the quotFile Uploadquot functionality of the Staging Upload (4) the username when creating a new user or (5) the IQ Server URL field in the IQ Server Connection functionality.