Description
Server-Side Request Forgery (SSRF) in the Remote Browser Plugin in Sonatype Nexus Repository 2.x up to and including 2.15.2 allows unauthenticated remote attackers to exfiltrate proxy repository credentials via crafted HTTP requests.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Sonatype | Nexus Repository | 2.0.0 – ≤ 2.15.2 | — |
Advisories 1
- WID-SEC-2025-2864 Sonatype Nexus Repository Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 16, 2025
References
- https://support.sonatype.com/hc/en-us/articles/45363201583635 vendor-advisory