PT-2025-41292 · Sonatype · Sonatype Nexus Repository

CVE-2025-9868 · Publicado 2025-10-08 · Atualizado 2025-10-08

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Sonatype Nexus Repository versions 2.0 through 2.15.2

Description A Server-Side Request Forgery (SSRF) exists in the Remote Browser Plugin. This allows unauthenticated remote attackers to extract proxy repository credentials via crafted HTTP requests. The issue affects the handling of HTTP requests, potentially enabling unauthorized access to sensitive data.

Recommendations Update Sonatype Nexus Repository to a version later than 2.15.2.

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2025-9868

Produtos afetados

Sonatype Nexus Repository

Referências · 5

• https://support.sonatype.com/hc/en-us/articles/45363201583635 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1975977585017229674 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-9868 · Nota de Segurança
• https://twitter.com/CveFindCom/status/1975979431714841040 · Publicação no Twitter
• https://t.me/CVEtracker/34473 · Publicação no Telegram