Security readout for executives and security teams
Plain-English summary
CVE-2019-7238 is a critical access-control flaw in Sonatype Nexus Repository Manager 3 before 3.15.0. Public sources associate it with remote code execution. Because CISA lists it in the Known Exploited Vulnerabilities catalog, exposed or outdated instances should be treated as urgent business risk.
Executive priority
Treat as immediate remediation work for any Nexus Repository Manager deployment. The combination of critical CVSS, unauthenticated network attack conditions, remote-code-execution framing, and CISA known-exploited status makes delay hard to justify.
Technical view
The CVE record describes incorrect access control in Nexus Repository Manager before 3.15.0, with CVSS 9.8: network exploitable, low complexity, no privileges, and no user interaction. Sonatype’s advisory title references missing access controls and remote code execution. CISA KEV confirms known exploitation.
Likely exposure
Organizations running Sonatype Nexus Repository Manager 3 before 3.15.0 are the indicated exposure group. Risk is higher where the service is reachable from the internet or from broad internal networks. The source bundle does not provide CPEs or detailed affected edition data.
Exploitation context
Active exploitation is supported by CISA KEV listing for CVE-2019-7238. The supplied sources do not provide exploit timing, actor attribution, exploitation volume, or indicators of compromise. Avoid assuming compromise without local validation.
Researcher notes
The evidence is strong on product family, version threshold, severity, and known exploitation. The source bundle is sparse on affected CPEs, editions, root cause, and detection artifacts, so validation should focus on version inventory, exposure mapping, and local log review.
Mitigation direction
- Upgrade Nexus Repository Manager 3 to version 3.15.0 or later per Sonatype guidance.
- Prioritize internet-facing Nexus Repository Manager instances first.
- Restrict network access to trusted administrative and build-system paths.
- Review Sonatype’s advisory for any current supplemental guidance.
- If upgrade is impossible, evaluate temporary isolation or service retirement.
Validation and detection
- Inventory all Nexus Repository Manager instances and record exact versions.
- Confirm no instance remains below 3.15.0.
- Identify whether any instance is internet-facing or broadly reachable internally.
- Review access logs and administrative changes for unexplained activity.
- Confirm remediation status against CISA KEV tracking requirements where applicable.
Public sources used
Michael Williams reviewed this cited source version on .
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2019-7238 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://support.sonatype.com/hc/en-us/articles/360017310793-CVE-2019-7238-Nexus-Repository-Manager-3-Missing-Access-Controls-and-Remote-Code-Execution-February-5th-2019CVE reference · x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-7238CVE reference · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.