critical9.8Known exploited
CVE-2019-7238
Sonatype Nexus Repository Manager Incorrect Access Control Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2021-12-10. Federal due date: 2022-06-10.
Apply updates per vendor instructions.
Impact
Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sonatype | Nexus Repository Manager | from 3.0.0 before 3.15.0 |
References
- NVD record
- CVE.org record
- CISA KEV catalog
- https://support.sonatype.com/hc/en-us/articles/360017310793-CVE-2019-7238-Nexus-Repository-Manager-3-Missing-Access-Controls-and-Remote-Code-Execution-February-5th-2019
- https://support.sonatype.com/hc/en-us/articles/360017310793-CVE-2019-7238-Nexus-Repository-Manager-3-Missing-Access-Controls-and-Remote-Code-Execution-February-5th-2019
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-7238