CVE-2019-7238

Sonatype Nexus Repository Manager versions before 3.15.0 have a flaw that allows unauthorized users to access or modify repository contents that should be restricted. This is critical because repositories often contain sensitive software components.

The vulnerability stems from improper access control enforcement in Nexus Repository Manager prior to version 3.15.0, allowing unauthenticated or low-privileged attackers to bypass permission checks and access protected repositories. The attack requires network access to the Nexus instance with no special preconditions, resulting in unauthorized read/write access to repository data.