CVE-2019-7238
Sonatype Nexus Repository Manager Incorrect Access Control Vulnerability
Description
CVE-2019-7238 is a critical incorrect access control vulnerability in Sonatype Nexus Repository Manager 3 that allows unauthenticated remote code execution. Versions of Nexus Repository Manager 3 prior to 3.15.0 contain an access control flaw that enables attackers to execute arbitrary code on the server without authentication. This Sonatype Nexus vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, confirming active exploitation. With an EPSS score of 94.38% (99.9th percentile), CVE-2019-7238 has a near-certain probability of exploitation, representing a critical risk for organizations running unpatched Nexus Repository Manager instances.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| sonatype | nexus repository manager | >= 3.0.0, < 3.15.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
Weakness Type
CWE-284: Improper Access Control
Improper Access Control is a vulnerability that occurs when software does not properly restrict access to resources or functionality, allowing unauthorized actors to perform actions or access data beyond their intended permissions. In Sonatype Nexus Repository Manager 3, the incorrect access control allows unauthenticated users to access functionality that should require authentication, ultimately enabling remote code execution.
Learn more: CWE-284 — Improper Access Control
Impact Analysis
CVE-2019-7238 carries a CVSS 3.1 score of 9.8 (CRITICAL), indicating maximum-severity risk to affected deployments. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication, and needs no user interaction, making it trivially exploitable by remote attackers. Successful exploitation fully compromises confidentiality, integrity, and availability of the Nexus Repository Manager server, allowing attackers to access stored artifacts and credentials, modify repositories and build configurations, and disrupt the software supply chain managed by the repository. Since Nexus Repository Manager is widely used as a central artifact repository in CI/CD pipelines, a compromise could enable supply chain attacks affecting all downstream software builds. The EPSS score of 94.38% confirms near-certain exploitation activity.
Exploit Maturity
CVE-2019-7238 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog, with a remediation deadline of 2022-06-10. The EPSS score of 94.38% (99.9th percentile) indicates near-certain exploitation probability, placing this among the most actively targeted vulnerabilities. The vendor advisory from Sonatype provides detailed information about the access control weakness and its exploitation potential. Given the critical role of repository managers in software supply chains, this vulnerability is highly attractive to attackers seeking to compromise build infrastructure.
Remediation
- Upgrade Nexus Repository Manager 3 to version 3.15.0 or later immediately, as mandated by CISA KEV. This version addresses the incorrect access control vulnerability that enables remote code execution.
- Verify that all Nexus Repository Manager 3 instances across the organization have been updated, including development, staging, and production deployments running versions 3.0.0 through 3.14.x.
- Restrict network access to Nexus Repository Manager using firewall rules and reverse proxy configurations, ensuring the management interface is not directly exposed to the internet and only accessible from authorized networks.
- Audit repository manager logs for indicators of compromise, including unauthorized access attempts, unexpected repository modifications, artifact uploads from unknown sources, and suspicious administrative actions.
- Review and harden access control configurations by enabling authentication for all repository access, implementing role-based access control with least-privilege principles, and enabling audit logging for all administrative operations.
Technical Details
CVE-2019-7238 is an incorrect access control vulnerability in Sonatype Nexus Repository Manager 3 versions prior to 3.15.0. The flaw stems from missing access control checks on certain API endpoints or functionality, allowing unauthenticated remote users to interact with the repository manager in ways that should require authentication. This access control gap can be leveraged to achieve remote code execution on the underlying server. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms the vulnerability is network-accessible with no prerequisites for exploitation, resulting in complete compromise of the repository manager's confidentiality, integrity, and availability. The critical nature of this vulnerability is amplified by the typical deployment context of Nexus Repository Manager as a central component in software build and deployment pipelines.
Frequently Asked Questions
Is CVE-2019-7238 being actively exploited?
Yes. CVE-2019-7238 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation. The EPSS score of 94.38% (99.9th percentile) indicates near-certain exploitation activity against exposed Nexus Repository Manager instances.
What products are affected by CVE-2019-7238?
CVE-2019-7238 affects Sonatype Nexus Repository Manager 3 versions 3.0.0 through 3.14.x. All installations running these versions are vulnerable to the incorrect access control flaw that enables remote code execution.
How do I fix CVE-2019-7238?
Upgrade to Sonatype Nexus Repository Manager 3 version 3.15.0 or later. Restrict network access to the repository manager interface and ensure it is not exposed to the public internet. Enable authentication for all repository access.
How severe is CVE-2019-7238?
CVE-2019-7238 has a CVSS 3.1 score of 9.8 (CRITICAL). It allows unauthenticated remote code execution with no user interaction required. The EPSS score of 94.38% (99.9th percentile) confirms this is among the most actively exploited vulnerabilities.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.