Actively exploited · Published Mar 21, 2019 · Assigned by mitre
CVE-2019-7238
Critical 9.8 Exploited
In plain English
A critical-severity security flaw in Nexus Repository Manager from Sonatype. Attackers are actively exploiting it in the wild (listed by CISA on December 10, 2021). The chance it is exploited in the next 30 days is estimated at 76.6% (higher than 99.5% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Apply updates per vendor instructions.
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)76.6%top 0.5% of all CVEs
Exploited in the wildYesCISA KEV since Dec 10, 2021
Attack tooling2Nuclei, Public PoC
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Jun 10, 2022.
Official description
Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control.