To solve the issue with the Tomcat vulnerability "Ghostcat", Nexus' customers must adapt their configuration.
A critical Tomcat vulnerability was identified with a CVSS-v3-Score of 9.8 of possible 10. The vulnerability can be used to extract configurations and secrets from the affected servers and allows remote code execution. The blind spot here is the Tomcat AJP port, by default on port 8009, which allows unauthenticated access to all Tomcat files.