CVE-2025-9868 — Nexus Repository 2 - SSRF Vulnerability in Remote Browser Plugin

CVE-2025-9868

Nexus Repository 2 - SSRF Vulnerability in Remote Browser Plugin PUBLISHED

Description (CNA)

Server-Side Request Forgery (SSRF) in the Remote Browser Plugin in Sonatype Nexus Repository 2.x up to and including 2.15.2 allows unauthenticated remote attackers to exfiltrate proxy repository credentials via crafted HTTP requests.

Affected (CNA)

Vendor / product	Versions
Sonatype / Nexus Repository	affected 2.0.0 through 2.15.2

CWE

CWE-918

References

https://support.sonatype.com/hc/en-us/articles/45363201583635

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.