# CVE-2020-10204: Sonatype Nexus - RCE

> Live exploitation tracking for CVE-2020-10204 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2020-10204

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 7.2
- **Public exploit available:** Yes
- **Affected products:** Sonatype Nexus
- **Weaknesses:** CWE-20 (Improper Input Validation)
- **Tags:** enterprise_software, management_panel

## Description

Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution.

## CrowdSec analysis

[CVE-2020-10204](https://euvd.enisa.europa.eu/vulnerability/CVE-2020-10204) is a high-severity remote code execution vulnerability in Sonatype Nexus Repository versions before 3.21.2. An authenticated attacker with high-level privileges can exploit the flaw remotely to execute arbitrary code, potentially compromising repository data, the underlying server, and system availability.

CrowdSec has been tracking this vulnerability and its exploits since 25th of August 2026.

CrowdSec network data shows that most actors exploiting CVE-2020-10204 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature.
CrowdSec data also reveals a clear uptick in attacks involving CVE-2020-10204 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.

Attackers target Nexus Repository Manager’s `/service/rapture/session` and `/service/extdirect` endpoints, authenticating before submitting a crafted `coreui_User` update request. The exploit injects an Expression Language payload into the user `roles` field to trigger remote code execution.

## Timeline

- 2020-04-01: CVE Published. CVE-2020-10204 is published to NVD.
- 2026-08-25: Rule Released. CrowdSec releases a rule to detect CVE-2020-10204 exploitation attempts against the CrowdSec Network.
- 2026-09-03: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2020-10204 for the first time.

## References

- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-10204.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2020-10204) follows observed exploitation activity for CVE-2020-10204. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.