Nexus Repository 3のSSO無効化を回避、修正版あり
Summary
Nexus Repository 3 ProでSAMLやOpenID Connectを使う組織では、管理者が無効化やロックをした利用者が、再びログインできてしまいます。3.98.0以降へ更新し、停止した人のIdP側アカウントの状態も見直してください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
Nexus Repository 3 ProでSAMLやOpenID Connectを使う組織では、管理者が無効化やロックをした利用者が、再びログインできてしまいます。3.98.0以降へ更新し、停止した人のIdP側アカウントの状態も見直してください。
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| Sonatype | Nexus Repository 3 |
≥ 3.86.0, < 3.98.0 |
3.98.0 |
Original description The description as published by the source.
Sonatype Nexus Repository 3 Pro does not check the local account status when a user signs in through a configured SAML or OAuth2/OpenID Connect identity provider. A user whose account was disabled or locked by an administrator in Nexus Repository can sign in again with valid identity provider credentials for the same account, and then receives a new session with the roles of that account. The attacker needs no Nexus Repository session and no Nexus Repository privilege. The attacker needs a named account that holds valid credentials at the identity provider. The anonymous user is not part of this attack path.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web help.sonatype.com
- web support.sonatype.com
- web nvd.nist.gov
- web support.sonatype.com
- web github.com