Description
In affected versions of Nexus Repository 3, the script execution endpoint (POST /service/rest/v1/script/{name}/run) did not verify whether script execution had been administratively disabled. An account holding script-execution permission could continue to run previously-created scripts even after an administrator set nexus.scripts.allowCreation=false, undermining the expectation that this setting fully blocks script execution.
Remediation
References
Related Vulnerabilities
WordPress Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2024-31210)
WordPress Plugin GamePress-The Game Database Cross-Site Scripting (1.1.0)
PostgreSQL Permissions, Privileges, and Access Controls Vulnerability (CVE-2016-3065)
WordPress Plugin Zingiri Web Shop 'abspath' Parameter Remote File Include (2.4.6)