Sonatype Nexus Repository Manager Incorrect Access Control Vulnerability

CRITICAL 9.8EXPLOITED (CISA KEV)CVE-2019-7238 · Published 21/03/2019 · updated 17/06/2026

Sonatype Nexus Repository Manager Incorrect Access Control Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 10/12/2021. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
nexus repository manager sonatype	`≥ 3.0.0, < 3.15.0`	`3.15.0`

Description

Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control.

References

support.sonatype.com/hc/en-us/articles/360017310793-CVE-2019-7238-Nexus-Repository-Manager-3-Missing-Access-Controls-and-Remote-Code-Execution-February-5th-2019 · Vendor Advisory
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2019-7238

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free