PT-2025-41292 · Sonatype · Sonatype Nexus Repository

Published 2025-10-08 · Updated 2025-10-08 · CVE-2025-9868

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Sonatype Nexus Repository versions 2.0 through 2.15.2

Description A Server-Side Request Forgery (SSRF) exists in the Remote Browser Plugin. This allows unauthenticated remote attackers to extract proxy repository credentials via crafted HTTP requests. The issue affects the handling of HTTP requests, potentially enabling unauthorized access to sensitive data.

Recommendations Update Sonatype Nexus Repository to a version later than 2.15.2.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-9868

Affected Products

Sonatype Nexus Repository

References · 5

• https://support.sonatype.com/hc/en-us/articles/45363201583635 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-9868 · Security Note
• https://twitter.com/CVEnew/status/1975977585017229674 · Twitter Post
• https://twitter.com/CveFindCom/status/1975979431714841040 · Twitter Post
• https://t.me/CVEtracker/34473 · Telegram Post