Threats tagged 'ghsa-cjj9-qvgx-24vv'

A vulnerability in Sonatype Nexus Repository 3 allows a user with edit permissions on a hosted OCI repository to inject script content into the artifact type field of an OCI manifest. This script executes in the browser of any user who views the Attestations tab for the related image in the Browse UI, running with the permissions of the viewing user. This cross-site scripting (XSS) vulnerability can lead to unauthorized script execution in the context of the Nexus Repository web interface.