CVE-2019-7238

What is Sonatype Nexus Repository Manager?

Nexus Repository Manager is a widely used artifact repository (for Maven, npm, Docker, and other package formats) that development teams host internally to manage software dependencies and build artifacts across the CI/CD pipeline. Because it sits at the heart of the software supply chain and is often reachable by build infrastructure, a compromised Nexus instance can be leveraged to poison builds or pivot deeper into an organization's network.

Overview

CVE-2019-7238 is an incorrect access control vulnerability in Nexus Repository Manager versions before 3.15.0 that allows an attacker to reach privileged internal functionality and achieve remote code execution. It is rated critical (CVSS 9.8) and was actively exploited in the wild not long after disclosure — mass scanning of internet-exposed Nexus servers to install cryptocurrency-mining malware was reported within months of the fix shipping.

Affected Versions

Technical Details

The vulnerability arises from access controls on certain Nexus REST/internal API endpoints that fail to properly restrict what an unauthenticated or low-privileged caller can invoke, letting an attacker reach functionality intended for administrators. Chained with the product's task-execution or scripting features, this can be escalated into full remote code execution on the host running Nexus.

Discovery

Sonatype disclosed and patched the issue in the 3.15.0 release (March 2019); NVD does not credit an individual external researcher.

Exploitation Context

Following public disclosure, security researchers and threat-intelligence teams observed mass internet scanning for exposed, unpatched Nexus Repository Manager instances, with successful compromises used to deploy cryptocurrency-mining malware. CISA's KEV listing confirms this history of confirmed real-world exploitation.

Remediation

1. Upgrade Nexus Repository Manager to 3.15.0 or later immediately.
2. Never expose the Nexus admin interface or REST API directly to the internet — restrict access to build infrastructure and VPN-connected users.
3. Review Nexus and host-level logs for unexpected task creation, script execution, or outbound connections consistent with cryptomining.
4. Rotate any credentials or repository tokens that may have been accessible from a compromised instance.
5. Apply least-privilege principles to Nexus user roles and disable unused REST endpoints where possible.