中
6.3
Sonatype Nexus Repository 3 allows a user account that can push manifests to a hosted OCI...
CVE-2026-113369
SecPulse初出
影響パッケージ
| 種類 | パッケージ | 影響を受ける版 | 修正版 |
|---|---|---|---|
| Sonatype | Nexus Repository 3 |
3.94.0 以上 3.98.0 未満 |
3.98.0 |
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
Sonatype Nexus Repository 3 allows a user account that can push manifests to a hosted OCI repository (a user account that holds the edit permission on that repository) to store script content in the artifact type field of an OCI manifest. The script runs in the browser of a user who opens the Attestations tab for the related image in the Browse user interface, with the permissions of the viewing user.
出典: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
参照URL
- web help.sonatype.com
- web support.sonatype.com
- web nvd.nist.gov
- web support.sonatype.com
- web github.com