Skip to content
OpenAdvisories
Medium WID-SEC-2025-2864 3 CVEs

Sonatype Nexus Repository Manager: Mehrere Schwachstellen

Published Dec 16, 2025 · Updated Dec 16, 2025 · de-DE

Vendor: Sonatype Product: Nexus Repository Manager Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Sonatype Nexus Repository Manager ausnutzen, um Informationen offenzulegen und Cross-Site-Scripting-Angriffe durchzuführen.

Product

Sonatype Nexus Repository Manager ist ein Verwaltungstool für Software-Bestandteile.

Vulnerabilities 3

  • High 8.7
    CVE-2025-9868

    Nexus Repository 2 - SSRF Vulnerability in Remote Browser Plugin

    Server-Side Request Forgery (SSRF) in the Remote Browser Plugin in Sonatype Nexus Repository 2.x up to and including 2.15.2 allows unauthenticated remote attackers to exfiltrate proxy repository credentials via crafted HTTP requests.

    Sonatype Nexus Repository
  • Medium 5.9
    CVE-2024-5764 Public exploit

    Nexus Repository 3 - Static hard-coded encryption passphrase used by default

    Use of Hard-coded Credentials vulnerability in Sonatype Nexus Repository has been discovered in the code responsible for encrypting any secrets stored in the Nexus Repository configuration database (SMTP or HTTP proxy credentials, user tokens, tokens, among o…

    Sonatype Nexus Repository
  • Medium 5.1
    CVE-2025-13488

    Nexus Repository 3 - Stored Cross-Site Scripting (XSS)

    Due to a regression introduced in version 3.83.0, a security header is no longer applied to certain user-uploaded content served from repositories. This may allow an authenticated attacker with repository upload privileges to exploit a stored cross-site scrip…

    Sonatype Nexus Repository

Revision history

  1. #1

    Initiale Fassung

References