A Directory Traversal issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.19. A user that requests a crafted path can traverse up the file system to get access to content on disk (that the user running nxrm also has access to).
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15012
Reference (s):
- https://support.sonatype.com/hc/en-us/articles/360051068253