VulnerabilityModified

CVE-2018-5306

MEDIUM 6.1EPSS 1.09%

Does this matter?

Lower severity and a low EPSS score (1.09%). Track it; it rarely justifies an emergency change on its own.

Description

Multiple cross-site scripting (XSS) vulnerabilities in Sonatype Nexus Repository Manager (aka NXRM) 3.x before 3.8 allow remote attackers to inject arbitrary web script or HTML via (1) the repoId or (2) format parameter to service/siesta/healthcheck/healthCheckFileDetail/.../index.html; (3) the filename in the "File Upload" functionality of the Staging Upload; (4) the username when creating a new user; or (5) the IQ Server URL field in the IQ Server Connection functionality.

CVSS 3.0: 6.1 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS: 1.09% probability · 65th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-79
Affected: sonatype/nexus repository manager
Source: cve@mitre.org

EPSS trend

EPSS 1.1% since 27 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.

References

http://seclists.org/fulldisclosure/2018/Feb/23Mailing List, Third Party Advisory
https://support.sonatype.com/hc/en-us/articles/360000134968Vendor Advisory
https://www.sec-consult.com/en/blog/advisories/multiple-cross-site-scripting-vulnerabilities-in-sonatype-nexus-repository-manager-oss-pro/index.htmlExploit, Third Party Advisory
http://seclists.org/fulldisclosure/2018/Feb/23Mailing List, Third Party Advisory
https://support.sonatype.com/hc/en-us/articles/360000134968Vendor Advisory
https://www.sec-consult.com/en/blog/advisories/multiple-cross-site-scripting-vulnerabilities-in-sonatype-nexus-repository-manager-oss-pro/index.htmlExploit, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.