Description
Use of Hard-coded Credentials vulnerability in Sonatype Nexus Repository has been discovered in the code responsible for encrypting any secrets stored in the Nexus Repository configuration database (SMTP or HTTP proxy credentials, user tokens, tokens, among others). The affected versions relied on a static hard-coded encryption passphrase. While it was possible for an administrator to define an alternate encryption passphrase, it could only be done at first boot and not updated.
This issue affects Nexus Repository: from 3.0.0 through 3.72.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Sonatype | Nexus Repository | 3.0.0 – ≤ 3.72.0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
fin3ss3g0d/CVE-2024-5764 ★ 1 · Nov 14, 2024
CVE-2024-5764 exploitation script
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- WID-SEC-2025-2864 Sonatype Nexus Repository Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 16, 2025
References
- https://support.sonatype.com/hc/en-us/articles/34496708991507 vendor-advisory