Sonatype Nexus Repository CVE-2025-9868

Exploitation requires network reachability to a Sonatype Nexus Repository 2.x instance (versions up to and including 2.15.2) whose Remote Browser Plugin is present/enabled, and requires that the instance has stored credentials for one or more authenticated proxy repositories (otherwise there is nothing to exfiltrate). Per the CVSS vector (PR:N/UI:N/AC:L) no authentication or user interaction is needed and complexity is low. The principal limiting factors are: the target being on the legacy 2.x line (Nexus 3 is unaffected by this advisory), the Remote Browser Plugin being active, and the presence of configured proxy-repo credentials worth stealing.

This is a genuinely high-risk issue that warrants prompt attention on affected instances. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) describes an unauthenticated, network-reachable, low-complexity flaw whose entire impact is confidentiality (VC:H, with VI/VA:N) - consistent with the CWE-918 SSRF being leveraged to exfiltrate stored proxy-repository credentials rather than to achieve code execution. My independent CVSS 3.1 mapping (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N ≈ 7.5) aligns with the vendor's 8.7 in shape, the difference stemming from 4.0's weighting of a high-value confidentiality-only outcome. Countervailing the severity: no EPSS score was supplied, the CVE is NOT on CISA KEV, and no public POC is referenced - only a Sonatype support advisory. So while the pre-conditions for exploitation are minimal (unauthenticated, remote), there is no evidence of active exploitation or weaponized tooling at this time. The realistic risk is elevated because credential theft from a build/artifact pipeline enables downstream compromise, but it is currently a patch-promptly rather than drop-everything item absent exploitation signals. Note the affected line (Nexus Repository 2.x, EOL legacy) narrows real-world exposure versus current Nexus 3 deployments.

An unauthenticated attacker who can reach the Nexus Repository 2.x web interface sends a crafted HTTP request that abuses the Remote Browser Plugin to make the server issue attacker-influenced outbound requests, coercing Nexus into disclosing the credentials it stores for authenticating to upstream proxy repositories. The stolen credentials are then reused to access or poison those upstream artifact sources. No public exploit code is referenced, but the low attack complexity and lack of authentication make weaponization straightforward if the plugin is exposed.