CVE-2019-7238

Deeper analysis

Sonatype Nexus Repository Manager versions prior to 3.15.0 contain an incorrect access control vulnerability that permits unauthorized interaction with repository functions. The flaw affects the core access control mechanisms of the widely deployed artifact repository server and carries a CVSS 3.1 base score of 9.8, reflecting network-accessible attack vectors that require no authentication or user interaction.

An unauthenticated remote attacker can exploit the missing controls to achieve remote code execution, resulting in complete compromise of confidentiality, integrity, and availability on the affected server. Because the vulnerability can be reached directly over the network, any exposed Nexus instance is potentially reachable by an attacker on the internet or within an internal network segment.

The official Sonatype advisory published on 5 February 2019 explicitly links the access-control deficiency to remote code execution and recommends upgrading to version 3.15.0 or later. The same issue appears in the CISA Known Exploited Vulnerabilities catalog, confirming that in-the-wild exploitation has been observed.