Sonatype
Monthly
Targeted repository denial-of-service in Sonatype Nexus Repository 3 allows any authenticated user holding deploy privileges to permanently disable component browsing on a specific hosted Maven repository. Uploading a crafted POM file with an oversized metadata field (CWE-770) corrupts the repository's internal data such that subsequent listing and browse operations fail indefinitely until an administrator repairs the underlying record. Impact is confined to the single targeted repository; the broader Nexus instance and all other repositories remain unaffected. No public exploit has been identified at time of analysis.
Improper authorization in Sonatype Nexus Repository 3 exposes repository metadata to users who lack direct permissions on those repositories. An account holding read or browse access on a group repository can directly query the REST API endpoint `GET /service/rest/v1/repositories/{repositoryName}` for any member repository by name, bypassing the access control checks that normally restrict visibility. For proxy-type member repositories, the disclosed metadata includes the configured remote URL, potentially revealing internal upstream hostnames or artifact mirror addresses that operators intend to keep private. No public exploit has been identified at time of analysis, and the issue is patched in version 3.96.0.
The webhook shared secret stored in Nexus Repository 3's capability configuration is returned unmasked via the capability read API, exposing a sensitive HMAC credential to any account holding the nexus:capabilities:read privilege. Affected versions span 3.2.0 through 3.95.x - a broad exposure window stretching back to an early release - with a confirmed fix in version 3.96.0 published by Sonatype. No public exploit or active exploitation has been identified, but a leaked webhook secret enables downstream abuse including forging authenticated webhook payloads or validating intercepted outbound events targeting CI/CD or pipeline endpoints.
Script execution enforcement failure in Sonatype Nexus Repository 3 allows privileged authenticated users to invoke pre-existing Groovy scripts via POST /service/rest/v1/script/{name}/run even after administrators explicitly set nexus.scripts.allowCreation=false to disable the scripting subsystem. The execution endpoint did not consult the administrative flag, meaning a hardening action administrators believed fully blocked script activity was silently ineffective against execution of pre-existing scripts. A vendor-released patch is available in Nexus Repository 3.96.0; no active exploitation has been confirmed in CISA KEV and no public proof-of-concept has been identified.
Incorrect authorization in Sonatype Nexus Repository 3 allows a low-privileged user holding the `nexus:blobstores:create` permission to invoke two blobstore group management REST API endpoints that should instead require `nexus:blobstores:update`. By calling these endpoints, the user can convert any existing blobstore into a group blobstore - a structural configuration change - without administrator approval. No public exploit has been identified, but the issue is self-reported by Sonatype and a patch is available in version 3.96.0.
Privilege escalation in Sonatype Nexus Repository 3 allows an authenticated user holding privilege-management rights to elevate their own access to full administrator by exploiting a type-confusion flaw (CWE-843) in the REST privilege update endpoint. Exploitation is constrained to specific role configurations, but the network-accessible attack surface and high confidentiality and integrity impact (VC:H/VI:H per the CVSS 4.0 vector) make this a meaningful insider or compromised-account risk in enterprise DevOps environments. A vendor-released patch is available in the Nexus Repository 3.95.0 release; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in Sonatype Nexus Repository 3 (and legacy Nexus Repository 2) is achievable by any account holding the nexus:settings:update permission, which can submit arbitrary strings as realm identifiers to an internal configuration API that performs no validation against the registered realm set. Because unrecognized identifiers are persisted and re-evaluated on every realm load through a legacy code path (CWE-470, unsafe reflection), this allows unintended code to execute inside the Nexus Repository server process and can cause a persistent authentication lockout that is invisible through the administrative UI. A vendor-released patch is confirmed in Nexus Repository 3.95.0; no public exploit or CISA KEV listing has been identified at time of analysis.
Incorrect authorization in the Nexus Repository 3 CE/Pro repository-creation UI allows an authenticated user with a format-scoped delegated repository-admin privilege to create repositories in unauthorized formats - bypassing the intended scope boundary. Affected are all releases from 3.0.0 through 3.94.x; version 3.95.0 resolves the flaw. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, but the integrity impact is high given that unauthorized repository types could be introduced into a managed artifact store, potentially tainting software supply chain pipelines.
JEXL expression sandbox bypass in Sonatype Nexus Repository 3's Content Selector feature allows authenticated users holding the nexus:selectors:create permission to traverse Java object properties outside the intended sandbox scope, disclosing internal JVM metadata such as class and classloader names. The vendor description explicitly confirms this does not permit method invocation, object construction, or code execution - making the 'RCE' intelligence tag a misclassification. Fixed in version 3.95.0; no public exploit or active exploitation has been identified at time of analysis.
Stored XSS in Sonatype Nexus Repository 3 enables an authenticated user holding blob store management permissions to inject arbitrary JavaScript into a blob store name, which later executes in the browser of any user who views the system health-check status page. The CVSS 4.0 vector's SC:H/SI:H scores underscore that the subsequent-system impact is high - an attacker-controlled script running in a victim's session can exfiltrate credentials or perform privileged actions on their behalf. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Sonatype has released a fix in version 3.95.0.
Scheduled task configuration overwrite in Sonatype Nexus Repository 3 enables a low-privileged authenticated user - holding permission to create at least one scheduled task type - to corrupt the configuration of an unrelated existing task via mass assignment against the administrative UI. By injecting internal configuration keys into user-supplied task property values, the attacker causes the system to redirect its write operation onto a pre-existing task rather than creating a new one, disrupting or manipulating that task's behavior. No public exploit or active exploitation has been identified; vendor-released patch 3.95.0 resolves the issue.
Unverified password change in Sonatype Nexus Repository 3 allows any account holding the nexus:* permission to overwrite the administrator password by invoking an onboarding-phase endpoint that remains accessible after initial setup is complete. The endpoint enforces access using only the presence of a local onboarding artifact rather than a proper lifecycle state check, enabling a privileged-but-non-admin account to hijack the administrator credential without invalidating existing administrator sessions. No public exploit has been identified at time of analysis and Sonatype has released a fix in version 3.95.0.
Insufficient session expiration in Sonatype Nexus Repository 3 allows a previously-authenticated user to retain full repository access after their account is deleted, deactivated, or their password is changed. Any user holding an active session at the moment of an administrative revocation event can continue reading, modifying, or deleting repository content until that session naturally times out - bypassing the intended access control action. No public exploit has been identified and this is not listed in CISA KEV, but the CVSS 4.0 score of 8.7 reflects the high-impact triad of confidentiality, integrity, and availability against network-accessible repositories once the prerequisite session exists.
Privilege escalation in Sonatype Nexus Repository 3 allows an authenticated low-privileged user - who holds the 'update privilege definitions' permission - to silently elevate themselves to full administrative access by editing wildcard privilege definitions already scoped to their own role. No additional authorization check, role reassignment, or administrator approval is required for this escalation. No public exploit code has been identified at time of analysis, but the CVSS 4.0 score of 8.9 and the complete confidentiality, integrity, and availability impact - including lateral impact on downstream systems - indicate high real-world risk for any organization using Nexus Repository 3 as a software supply chain hub.
Remote code execution in Sonatype Nexus Repository 3 is achievable by any user holding the nx-datastores-update permission, who can exploit an insufficiently restricted HikariCP connection-pool property passthrough in the DataStore configuration API to inject arbitrary SQL via the connectionInitSql property. On the default H2 embedded database backend - common in non-production and smaller deployments - H2's ability to invoke Java methods from SQL allows this injection to escalate to OS-level command execution as the Nexus process user. No public exploit has been identified at time of analysis, but the H2-to-RCE escalation path is a well-understood Java ecosystem technique that lowers the practical skill bar significantly.
The email configuration verification endpoint in Sonatype Nexus Repository 3 (CE and Pro editions through 3.94.1) allows authenticated users holding the nexus:settings:update permission to submit arbitrary host and port values, causing the server to probe internal or restricted network addresses via Server-Side Request Forgery. Differences in server responses - connection timing, error codes, and success signals - act as a side channel revealing which internal hosts and ports are reachable from the Nexus server, enabling internal network enumeration. No public exploit has been identified at time of analysis, and vendor-released patch version 3.95.0 resolves the issue.
SSRF protections in Sonatype Nexus Repository 3 are bypassed when proxy repository upstream servers return HTTP redirects, allowing those redirects to target internal network addresses or cloud metadata endpoints such as AWS IMDSv1. Any user with read access to an affected proxy repository - including anonymous users if anonymous access is enabled - can receive responses from internal infrastructure, potentially leaking cloud IAM credentials or other sensitive internal data. No public exploit or CISA KEV listing has been identified at time of analysis, but the condition relies on attacker-controlled or compromised upstream servers, making this a credible supply-chain-adjacent threat in enterprises relying on external upstream repositories.
Server-Side Request Forgery in Sonatype Nexus Repository 3 allows any holder of the Capability Administration permission to redirect the server's outbound HTTP requests to arbitrary internal network addresses by supplying a crafted URL in the Webhook Global capability configuration, enabling probing of internal infrastructure. The vulnerability is patched in version 3.94.0 per Sonatype's release notes. No public exploit code exists and the vulnerability is not in CISA KEV, but risk escalates materially on instances where the anonymous role has been granted the Capability Administration permission, as this exposes the SSRF to unauthenticated actors without any configuration changes beyond that role assignment.
Authorization bypass in Sonatype Nexus Repository 3's component upload API lets an account holding only read/browse privileges on a Swift, Terraform, or Conda hosted repository push arbitrary artifacts, defeating the intended write-permission check (CWE-862). The flaw affects the specific upload paths for these three formats and enables unauthorized artifact publishing that can poison downstream builds. No public exploit identified at time of analysis; Sonatype has shipped a fix in release 3.94.0.
Server-Side Request Forgery in Sonatype Nexus Repository 3 exposes internal network infrastructure to authenticated users holding the nexus:ssl-truststore:read permission, who can weaponize the SSL Certificate Retrieval endpoint to force the server to initiate outbound TCP connections to arbitrary hosts - including cloud metadata services, internal APIs, and otherwise firewalled systems. All versions from 3.0.0 up to (but not including) 3.94.0 are affected, and a vendor-released patch is available. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Improper API key generation in Sonatype Nexus Repository Manager lets a remote attacker impersonate a targeted user and perform repository operations on their behalf. The flaw stems from insufficient entropy (CWE-331) in format-specific API key realms, so an attacker who can predict or reconstruct a victim's key gains their access without credentials. The vendor (Sonatype) reported and patched the issue in release 3.93.0; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Incorrect authorization in Sonatype Nexus Repository Manager before 3.93.0 permits a delegated repository administrator to read stored upstream proxy credentials beyond their intended authorization scope. The flaw resides in the proxy repository configuration pathway, where role-scoped administrators can retrieve credentials that should be restricted to higher-privilege system-level accounts. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though the high confidentiality impact on stored upstream credentials is notable given that exposure enables potential unauthorized access to private upstream artifact repositories.
Arbitrary OS command execution in Sonatype Nexus Repository 3 versions prior to 3.92.0 allows authenticated users holding the nx-licensing-create privilege to run commands as the Nexus process user by uploading a malicious license file. The flaw is rooted in unsafe deserialization (CWE-502) during license processing. No public exploit identified at time of analysis.
Credential-guessing attacks against Sonatype Nexus Repository Manager are enabled by missing rate-limiting on authentication endpoints, allowing remote unauthenticated attackers to brute-force or password-spray valid user accounts. The flaw stems from improper restriction of excessive authentication attempts (CWE-307) and carries a CVSS 4.0 base score of 8.7 reflecting high confidentiality impact; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Stored cross-site scripting (XSS) in Sonatype Nexus Repository 3.6.0 through 3.91.x allows authenticated users with upload permissions to inject malicious JavaScript into repository content, which executes in the browsers of any user viewing the affected repository directory via the HTML index page. An attacker can perform unauthorized actions within a victim's session context, including potential data theft or privilege escalation depending on the victim's role. The vulnerability requires user interaction (clicking/viewing the malicious content) and prior repository upload access, limiting but not eliminating real-world risk in multi-tenant or open-source repository environments.
Server-side request forgery with deserialization characteristics in Sonatype Nexus Repository Manager 3.0.0 through 3.91.1 allows an authenticated administrator to initiate unintended outbound connections from the Nexus host by configuring or testing LDAP connectivity against an attacker-controlled LDAP server. The root cause is classified as CWE-502 (Deserialization of Untrusted Data), indicating that malicious serialized payloads returned by the rogue LDAP server may be processed by the Nexus application, yielding limited confidentiality and integrity impact on the host. No public exploit has been identified and CISA has not listed this in KEV; Sonatype has released a fix in version 3.92.0.
Hard-coded credentials in Sonatype Nexus Repository 3.0.0 through 3.70.5 allow unauthenticated attackers with network access to gain read/write access to the internal OrientDB database and execute arbitrary operating system commands as the Nexus process user when the `nexus.orient.binaryListenerEnabled` configuration is enabled. Exploitation
Use of Hard-coded Credentials vulnerability in Sonatype Nexus Repository has been discovered in the code responsible for encrypting any secrets stored in the Nexus Repository configuration database. Rated medium severity (CVSS 5.9), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Sonatype Nexus Repository Manager 3.x before 3.38.0 allows SSRF. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Sonatype Nexus Repository Manager 3.x before 3.36.0 allows a remote authenticated attacker to potentially perform network enumeration via Server Side Request Forgery (SSRF). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.
Sonatype Nexus Repository Manager 3.x through 3.35.0 allows attackers to access the SSL Certificates Loading function via a low-privileged account. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Sonatype Nexus Repository 3.x through 3.33.1-01 is vulnerable to an HTTP header injection. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Multiple XSS issues exist in Sonatype Nexus Repository Manager 3 before 3.33.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Sonatype Nexus Repository Manager 3.x before 3.31.0 allows a remote authenticated attacker to get a list of blob files and read the content of a blob file (via a GET request) without having been. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
A cross-site scripting (XSS) vulnerability has been discovered in Nexus Repository Manager 3.x before 3.30.1. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Sonatype Nexus Repository Manager 3.x before 3.30.1 allows a remote attacker to get a list of files and directories that exist in a UI-related folder via directory traversal (no customer-specific. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Sonatype Nexus Repository Manager 3 Pro up to and including 3.30.0 has Incorrect Access Control. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
Sonatype Nexus Repository Manager 3.x before 3.29.0 allows a user with admin privileges to configure the system to gain access to content outside of NXRM via an XXE vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A Directory Traversal issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.19. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
In Sonatype Nexus Repository 3.26.1, an S3 secret key can be exposed by an admin user. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Sonatype Nexus Repository Manager OSS/Pro before 3.26.0 has Incorrect Access Control. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Sonatype Nexus Repository Manager OSS/Pro version before 3.25.1 allows Remote Code Execution. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Sonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (Issue 2 of 2). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Sonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (issue 1 of 2). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
An issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.17 and 3.x before 3.22.1. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity.
An issue was discovered in Sonatype Nexus Repository Manager in versions 3.21.1 and 3.22.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
Sonatype Nexus Repository Manager 3.x up to and including 3.21.2 has Incorrect Access Control. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Default Permissions vulnerability could allow attackers to access resources due to overly permissive default settings.
Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
Sonatype Nexus Repository before 3.21.2 allows XSS. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
There is an OS Command Injection in Nexus Repository Manager <= 2.14.14 (bypass CVE-2019-5475) that could allow an attacker a Remote Code Execution (RCE). Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
Sonatype Nexus Repository Manager 2.x before 2.14.15 and 3.x before 3.19, and IQ Server before 72, has remote code execution. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. This Unrestricted File Upload vulnerability could allow attackers to upload malicious files that can be executed on the server.
Sonatype Nexus Repository Manager 2.x before 2.14.15 allows Remote Code Execution. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Nexus Yum Repository Plugin in v2 is vulnerable to Remote Code Execution when instances using CommandLineExecutor.java are supplied vulnerable data, such as the Yum Configuration Capability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
In Nexus Repository Manager before 3.18.0, users with elevated privileges can create stored XSS. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Sonatype Nexus Repository Manager before 3.17.0 has a weak default of giving any unauthenticated user read permissions on the repository files and images. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Sonatype Nexus Repository Manager before 3.17.0 establishes a default administrator user with weak defaults (fixed credentials). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Sonatype Nexus Repository Manager 2.x before 2.14.13 allows XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Sonatype Nexus Repository Manager before 3.14 allows Java Expression Language Injection. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Sonatype Nexus Repository Manager before 3.14 has Incorrect Access Control. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Sonatype Nexus Repository Manager before 3.14 allows XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Sonatype Nexus Repository Manager versions 3.x before 3.12.0 has XSS in multiple areas in the Administration UI. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in Sonatype Nexus Repository Manager (aka NXRM) 2.x before 2.14.6 allow remote attackers to inject arbitrary web script or HTML via (1) the repoId. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in Sonatype Nexus Repository Manager (aka NXRM) 3.x before 3.8 allow remote attackers to inject arbitrary web script or HTML via (1) the repoId or. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Sonatype Nexus Repository Manager through 2.14.5 has weak password encryption with a hardcoded CMMDwoV value in the LDAP integration feature. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Directory traversal vulnerability in Sonatype Nexus OSS and Pro before 2.11.1-01 allows remote attackers to read or write to arbitrary files via unspecified vectors. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Unspecified vulnerability in Sonatype Nexus OSS and Pro 2.4.0 through 2.7.1 allows attackers to create arbitrary user accounts via unknown vectors related to "an unauthenticated execution path.". Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Sonatype Nexus 1.x and 2.x before 2.7.1 allows remote attackers to create arbitrary objects and execute arbitrary code via unspecified vectors related to unmarshalling of unintended Object types. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
Targeted repository denial-of-service in Sonatype Nexus Repository 3 allows any authenticated user holding deploy privileges to permanently disable component browsing on a specific hosted Maven repository. Uploading a crafted POM file with an oversized metadata field (CWE-770) corrupts the repository's internal data such that subsequent listing and browse operations fail indefinitely until an administrator repairs the underlying record. Impact is confined to the single targeted repository; the broader Nexus instance and all other repositories remain unaffected. No public exploit has been identified at time of analysis.
Improper authorization in Sonatype Nexus Repository 3 exposes repository metadata to users who lack direct permissions on those repositories. An account holding read or browse access on a group repository can directly query the REST API endpoint `GET /service/rest/v1/repositories/{repositoryName}` for any member repository by name, bypassing the access control checks that normally restrict visibility. For proxy-type member repositories, the disclosed metadata includes the configured remote URL, potentially revealing internal upstream hostnames or artifact mirror addresses that operators intend to keep private. No public exploit has been identified at time of analysis, and the issue is patched in version 3.96.0.
The webhook shared secret stored in Nexus Repository 3's capability configuration is returned unmasked via the capability read API, exposing a sensitive HMAC credential to any account holding the nexus:capabilities:read privilege. Affected versions span 3.2.0 through 3.95.x - a broad exposure window stretching back to an early release - with a confirmed fix in version 3.96.0 published by Sonatype. No public exploit or active exploitation has been identified, but a leaked webhook secret enables downstream abuse including forging authenticated webhook payloads or validating intercepted outbound events targeting CI/CD or pipeline endpoints.
Script execution enforcement failure in Sonatype Nexus Repository 3 allows privileged authenticated users to invoke pre-existing Groovy scripts via POST /service/rest/v1/script/{name}/run even after administrators explicitly set nexus.scripts.allowCreation=false to disable the scripting subsystem. The execution endpoint did not consult the administrative flag, meaning a hardening action administrators believed fully blocked script activity was silently ineffective against execution of pre-existing scripts. A vendor-released patch is available in Nexus Repository 3.96.0; no active exploitation has been confirmed in CISA KEV and no public proof-of-concept has been identified.
Incorrect authorization in Sonatype Nexus Repository 3 allows a low-privileged user holding the `nexus:blobstores:create` permission to invoke two blobstore group management REST API endpoints that should instead require `nexus:blobstores:update`. By calling these endpoints, the user can convert any existing blobstore into a group blobstore - a structural configuration change - without administrator approval. No public exploit has been identified, but the issue is self-reported by Sonatype and a patch is available in version 3.96.0.
Privilege escalation in Sonatype Nexus Repository 3 allows an authenticated user holding privilege-management rights to elevate their own access to full administrator by exploiting a type-confusion flaw (CWE-843) in the REST privilege update endpoint. Exploitation is constrained to specific role configurations, but the network-accessible attack surface and high confidentiality and integrity impact (VC:H/VI:H per the CVSS 4.0 vector) make this a meaningful insider or compromised-account risk in enterprise DevOps environments. A vendor-released patch is available in the Nexus Repository 3.95.0 release; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in Sonatype Nexus Repository 3 (and legacy Nexus Repository 2) is achievable by any account holding the nexus:settings:update permission, which can submit arbitrary strings as realm identifiers to an internal configuration API that performs no validation against the registered realm set. Because unrecognized identifiers are persisted and re-evaluated on every realm load through a legacy code path (CWE-470, unsafe reflection), this allows unintended code to execute inside the Nexus Repository server process and can cause a persistent authentication lockout that is invisible through the administrative UI. A vendor-released patch is confirmed in Nexus Repository 3.95.0; no public exploit or CISA KEV listing has been identified at time of analysis.
Incorrect authorization in the Nexus Repository 3 CE/Pro repository-creation UI allows an authenticated user with a format-scoped delegated repository-admin privilege to create repositories in unauthorized formats - bypassing the intended scope boundary. Affected are all releases from 3.0.0 through 3.94.x; version 3.95.0 resolves the flaw. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, but the integrity impact is high given that unauthorized repository types could be introduced into a managed artifact store, potentially tainting software supply chain pipelines.
JEXL expression sandbox bypass in Sonatype Nexus Repository 3's Content Selector feature allows authenticated users holding the nexus:selectors:create permission to traverse Java object properties outside the intended sandbox scope, disclosing internal JVM metadata such as class and classloader names. The vendor description explicitly confirms this does not permit method invocation, object construction, or code execution - making the 'RCE' intelligence tag a misclassification. Fixed in version 3.95.0; no public exploit or active exploitation has been identified at time of analysis.
Stored XSS in Sonatype Nexus Repository 3 enables an authenticated user holding blob store management permissions to inject arbitrary JavaScript into a blob store name, which later executes in the browser of any user who views the system health-check status page. The CVSS 4.0 vector's SC:H/SI:H scores underscore that the subsequent-system impact is high - an attacker-controlled script running in a victim's session can exfiltrate credentials or perform privileged actions on their behalf. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Sonatype has released a fix in version 3.95.0.
Scheduled task configuration overwrite in Sonatype Nexus Repository 3 enables a low-privileged authenticated user - holding permission to create at least one scheduled task type - to corrupt the configuration of an unrelated existing task via mass assignment against the administrative UI. By injecting internal configuration keys into user-supplied task property values, the attacker causes the system to redirect its write operation onto a pre-existing task rather than creating a new one, disrupting or manipulating that task's behavior. No public exploit or active exploitation has been identified; vendor-released patch 3.95.0 resolves the issue.
Unverified password change in Sonatype Nexus Repository 3 allows any account holding the nexus:* permission to overwrite the administrator password by invoking an onboarding-phase endpoint that remains accessible after initial setup is complete. The endpoint enforces access using only the presence of a local onboarding artifact rather than a proper lifecycle state check, enabling a privileged-but-non-admin account to hijack the administrator credential without invalidating existing administrator sessions. No public exploit has been identified at time of analysis and Sonatype has released a fix in version 3.95.0.
Insufficient session expiration in Sonatype Nexus Repository 3 allows a previously-authenticated user to retain full repository access after their account is deleted, deactivated, or their password is changed. Any user holding an active session at the moment of an administrative revocation event can continue reading, modifying, or deleting repository content until that session naturally times out - bypassing the intended access control action. No public exploit has been identified and this is not listed in CISA KEV, but the CVSS 4.0 score of 8.7 reflects the high-impact triad of confidentiality, integrity, and availability against network-accessible repositories once the prerequisite session exists.
Privilege escalation in Sonatype Nexus Repository 3 allows an authenticated low-privileged user - who holds the 'update privilege definitions' permission - to silently elevate themselves to full administrative access by editing wildcard privilege definitions already scoped to their own role. No additional authorization check, role reassignment, or administrator approval is required for this escalation. No public exploit code has been identified at time of analysis, but the CVSS 4.0 score of 8.9 and the complete confidentiality, integrity, and availability impact - including lateral impact on downstream systems - indicate high real-world risk for any organization using Nexus Repository 3 as a software supply chain hub.
Remote code execution in Sonatype Nexus Repository 3 is achievable by any user holding the nx-datastores-update permission, who can exploit an insufficiently restricted HikariCP connection-pool property passthrough in the DataStore configuration API to inject arbitrary SQL via the connectionInitSql property. On the default H2 embedded database backend - common in non-production and smaller deployments - H2's ability to invoke Java methods from SQL allows this injection to escalate to OS-level command execution as the Nexus process user. No public exploit has been identified at time of analysis, but the H2-to-RCE escalation path is a well-understood Java ecosystem technique that lowers the practical skill bar significantly.
The email configuration verification endpoint in Sonatype Nexus Repository 3 (CE and Pro editions through 3.94.1) allows authenticated users holding the nexus:settings:update permission to submit arbitrary host and port values, causing the server to probe internal or restricted network addresses via Server-Side Request Forgery. Differences in server responses - connection timing, error codes, and success signals - act as a side channel revealing which internal hosts and ports are reachable from the Nexus server, enabling internal network enumeration. No public exploit has been identified at time of analysis, and vendor-released patch version 3.95.0 resolves the issue.
SSRF protections in Sonatype Nexus Repository 3 are bypassed when proxy repository upstream servers return HTTP redirects, allowing those redirects to target internal network addresses or cloud metadata endpoints such as AWS IMDSv1. Any user with read access to an affected proxy repository - including anonymous users if anonymous access is enabled - can receive responses from internal infrastructure, potentially leaking cloud IAM credentials or other sensitive internal data. No public exploit or CISA KEV listing has been identified at time of analysis, but the condition relies on attacker-controlled or compromised upstream servers, making this a credible supply-chain-adjacent threat in enterprises relying on external upstream repositories.
Server-Side Request Forgery in Sonatype Nexus Repository 3 allows any holder of the Capability Administration permission to redirect the server's outbound HTTP requests to arbitrary internal network addresses by supplying a crafted URL in the Webhook Global capability configuration, enabling probing of internal infrastructure. The vulnerability is patched in version 3.94.0 per Sonatype's release notes. No public exploit code exists and the vulnerability is not in CISA KEV, but risk escalates materially on instances where the anonymous role has been granted the Capability Administration permission, as this exposes the SSRF to unauthenticated actors without any configuration changes beyond that role assignment.
Authorization bypass in Sonatype Nexus Repository 3's component upload API lets an account holding only read/browse privileges on a Swift, Terraform, or Conda hosted repository push arbitrary artifacts, defeating the intended write-permission check (CWE-862). The flaw affects the specific upload paths for these three formats and enables unauthorized artifact publishing that can poison downstream builds. No public exploit identified at time of analysis; Sonatype has shipped a fix in release 3.94.0.
Server-Side Request Forgery in Sonatype Nexus Repository 3 exposes internal network infrastructure to authenticated users holding the nexus:ssl-truststore:read permission, who can weaponize the SSL Certificate Retrieval endpoint to force the server to initiate outbound TCP connections to arbitrary hosts - including cloud metadata services, internal APIs, and otherwise firewalled systems. All versions from 3.0.0 up to (but not including) 3.94.0 are affected, and a vendor-released patch is available. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Improper API key generation in Sonatype Nexus Repository Manager lets a remote attacker impersonate a targeted user and perform repository operations on their behalf. The flaw stems from insufficient entropy (CWE-331) in format-specific API key realms, so an attacker who can predict or reconstruct a victim's key gains their access without credentials. The vendor (Sonatype) reported and patched the issue in release 3.93.0; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Incorrect authorization in Sonatype Nexus Repository Manager before 3.93.0 permits a delegated repository administrator to read stored upstream proxy credentials beyond their intended authorization scope. The flaw resides in the proxy repository configuration pathway, where role-scoped administrators can retrieve credentials that should be restricted to higher-privilege system-level accounts. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though the high confidentiality impact on stored upstream credentials is notable given that exposure enables potential unauthorized access to private upstream artifact repositories.
Arbitrary OS command execution in Sonatype Nexus Repository 3 versions prior to 3.92.0 allows authenticated users holding the nx-licensing-create privilege to run commands as the Nexus process user by uploading a malicious license file. The flaw is rooted in unsafe deserialization (CWE-502) during license processing. No public exploit identified at time of analysis.
Credential-guessing attacks against Sonatype Nexus Repository Manager are enabled by missing rate-limiting on authentication endpoints, allowing remote unauthenticated attackers to brute-force or password-spray valid user accounts. The flaw stems from improper restriction of excessive authentication attempts (CWE-307) and carries a CVSS 4.0 base score of 8.7 reflecting high confidentiality impact; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Stored cross-site scripting (XSS) in Sonatype Nexus Repository 3.6.0 through 3.91.x allows authenticated users with upload permissions to inject malicious JavaScript into repository content, which executes in the browsers of any user viewing the affected repository directory via the HTML index page. An attacker can perform unauthorized actions within a victim's session context, including potential data theft or privilege escalation depending on the victim's role. The vulnerability requires user interaction (clicking/viewing the malicious content) and prior repository upload access, limiting but not eliminating real-world risk in multi-tenant or open-source repository environments.
Server-side request forgery with deserialization characteristics in Sonatype Nexus Repository Manager 3.0.0 through 3.91.1 allows an authenticated administrator to initiate unintended outbound connections from the Nexus host by configuring or testing LDAP connectivity against an attacker-controlled LDAP server. The root cause is classified as CWE-502 (Deserialization of Untrusted Data), indicating that malicious serialized payloads returned by the rogue LDAP server may be processed by the Nexus application, yielding limited confidentiality and integrity impact on the host. No public exploit has been identified and CISA has not listed this in KEV; Sonatype has released a fix in version 3.92.0.
Hard-coded credentials in Sonatype Nexus Repository 3.0.0 through 3.70.5 allow unauthenticated attackers with network access to gain read/write access to the internal OrientDB database and execute arbitrary operating system commands as the Nexus process user when the `nexus.orient.binaryListenerEnabled` configuration is enabled. Exploitation
Use of Hard-coded Credentials vulnerability in Sonatype Nexus Repository has been discovered in the code responsible for encrypting any secrets stored in the Nexus Repository configuration database. Rated medium severity (CVSS 5.9), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Sonatype Nexus Repository Manager 3.x before 3.38.0 allows SSRF. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Sonatype Nexus Repository Manager 3.x before 3.36.0 allows a remote authenticated attacker to potentially perform network enumeration via Server Side Request Forgery (SSRF). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.
Sonatype Nexus Repository Manager 3.x through 3.35.0 allows attackers to access the SSL Certificates Loading function via a low-privileged account. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Sonatype Nexus Repository 3.x through 3.33.1-01 is vulnerable to an HTTP header injection. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Multiple XSS issues exist in Sonatype Nexus Repository Manager 3 before 3.33.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Sonatype Nexus Repository Manager 3.x before 3.31.0 allows a remote authenticated attacker to get a list of blob files and read the content of a blob file (via a GET request) without having been. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
A cross-site scripting (XSS) vulnerability has been discovered in Nexus Repository Manager 3.x before 3.30.1. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Sonatype Nexus Repository Manager 3.x before 3.30.1 allows a remote attacker to get a list of files and directories that exist in a UI-related folder via directory traversal (no customer-specific. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Sonatype Nexus Repository Manager 3 Pro up to and including 3.30.0 has Incorrect Access Control. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
Sonatype Nexus Repository Manager 3.x before 3.29.0 allows a user with admin privileges to configure the system to gain access to content outside of NXRM via an XXE vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A Directory Traversal issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.19. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
In Sonatype Nexus Repository 3.26.1, an S3 secret key can be exposed by an admin user. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Sonatype Nexus Repository Manager OSS/Pro before 3.26.0 has Incorrect Access Control. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Sonatype Nexus Repository Manager OSS/Pro version before 3.25.1 allows Remote Code Execution. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Sonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (Issue 2 of 2). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Sonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (issue 1 of 2). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
An issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.17 and 3.x before 3.22.1. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity.
An issue was discovered in Sonatype Nexus Repository Manager in versions 3.21.1 and 3.22.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
Sonatype Nexus Repository Manager 3.x up to and including 3.21.2 has Incorrect Access Control. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Default Permissions vulnerability could allow attackers to access resources due to overly permissive default settings.
Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
Sonatype Nexus Repository before 3.21.2 allows XSS. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
There is an OS Command Injection in Nexus Repository Manager <= 2.14.14 (bypass CVE-2019-5475) that could allow an attacker a Remote Code Execution (RCE). Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
Sonatype Nexus Repository Manager 2.x before 2.14.15 and 3.x before 3.19, and IQ Server before 72, has remote code execution. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. This Unrestricted File Upload vulnerability could allow attackers to upload malicious files that can be executed on the server.
Sonatype Nexus Repository Manager 2.x before 2.14.15 allows Remote Code Execution. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Nexus Yum Repository Plugin in v2 is vulnerable to Remote Code Execution when instances using CommandLineExecutor.java are supplied vulnerable data, such as the Yum Configuration Capability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
In Nexus Repository Manager before 3.18.0, users with elevated privileges can create stored XSS. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Sonatype Nexus Repository Manager before 3.17.0 has a weak default of giving any unauthenticated user read permissions on the repository files and images. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Sonatype Nexus Repository Manager before 3.17.0 establishes a default administrator user with weak defaults (fixed credentials). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Sonatype Nexus Repository Manager 2.x before 2.14.13 allows XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Sonatype Nexus Repository Manager before 3.14 allows Java Expression Language Injection. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Sonatype Nexus Repository Manager before 3.14 has Incorrect Access Control. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Sonatype Nexus Repository Manager before 3.14 allows XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Sonatype Nexus Repository Manager versions 3.x before 3.12.0 has XSS in multiple areas in the Administration UI. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in Sonatype Nexus Repository Manager (aka NXRM) 2.x before 2.14.6 allow remote attackers to inject arbitrary web script or HTML via (1) the repoId. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in Sonatype Nexus Repository Manager (aka NXRM) 3.x before 3.8 allow remote attackers to inject arbitrary web script or HTML via (1) the repoId or. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Sonatype Nexus Repository Manager through 2.14.5 has weak password encryption with a hardcoded CMMDwoV value in the LDAP integration feature. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Directory traversal vulnerability in Sonatype Nexus OSS and Pro before 2.11.1-01 allows remote attackers to read or write to arbitrary files via unspecified vectors. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Unspecified vulnerability in Sonatype Nexus OSS and Pro 2.4.0 through 2.7.1 allows attackers to create arbitrary user accounts via unknown vectors related to "an unauthenticated execution path.". Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Sonatype Nexus 1.x and 2.x before 2.7.1 allows remote attackers to create arbitrary objects and execute arbitrary code via unspecified vectors related to unmarshalling of unintended Object types. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.