PatchSiren

PatchSiren cyber security CVE debrief

CVE-2020-10199 Sonatype CVE debrief

CVE-2020-10199 is a Sonatype Nexus Repository remote code execution vulnerability that CISA added to the Known Exploited Vulnerabilities catalog on 2021-11-03. The official guidance in the supplied corpus is to apply updates per vendor instructions, making this an urgent patching item for any affected deployment.

Vendor
Sonatype
Product
Nexus Repository
CVSS
Unknown
CISA KEV
Listed
Original CVE published
2021-11-03
Original CVE updated
2021-11-03
Advisory published
2021-11-03
Advisory updated
2021-11-03

Who should care

Security, platform, and application teams that operate Sonatype Nexus Repository instances, especially environments where the service is reachable from untrusted networks or is used as a central software supply-chain component.

Technical summary

The supplied official records identify CVE-2020-10199 as a remote code execution vulnerability in Sonatype Nexus Repository. CISA’s KEV entry marks it as known exploited and directs affected organizations to apply updates per vendor instructions. No further technical exploit detail or CVSS score is provided in the supplied corpus.

Defensive priority

Urgent

Recommended defensive actions

  • Identify all Sonatype Nexus Repository deployments, including test and auxiliary instances.
  • Apply the vendor-recommended updates as soon as possible.
  • Restrict network access to Nexus Repository until remediation is complete, if feasible.
  • Verify remediation after patching and confirm the instance is no longer on an affected version.
  • Track the CISA KEV due date of 2022-05-03 for remediation reporting and backlog management.

Evidence notes

This debrief is based only on the supplied CISA KEV source item and the official CVE/NVD links provided in the corpus. The corpus confirms the product, vulnerability class, KEV status, date added, due date, and the required action to apply updates per vendor instructions. No CVSS score, exploit chain details, or vendor advisory text beyond the KEV note was supplied.

Sources and references

Verified primary and authoritative sources

  • CVE-2020-10199 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2020-10199

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2020-10199 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2020-10199

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

  • CISA Known Exploited Vulnerabilities catalog

    Publisher, destination, and source semantics verified

    URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

    Cybersecurity and Infrastructure Security Agency - Official CISA catalog of vulnerabilities known to be exploited in the wild.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

    cisa_kev

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.