CVE-2019-7238
Sonatype Nexus Repository Manager Incorrect Access Control Vulnerability
- Published
- Mar 21, 2019
- Updated
- Oct 21, 2025
- Assigning CNA
- mitre
- Evidence observed
- Dec 10, 2021
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HHigh · next 30 days
- Percentile
- 99.6%
- Model date
- Oct 16, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
CISA Known Exploited
This CVE appears in the CISA Known Exploited Vulnerabilities catalog.
Summary
Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control.
Sources
nexus/CVE-2019-7238
Nexus Repository Manager 3 Unauthenticated Remote Code Execution (CVE-2019-7238)
Vulhub vulnerability labsDeclared conditions
- lab image version: vulhub/nexus:3.14.0(nexus/CVE-2019-7238/docker-compose.yml:services.web.image)
http/cves/2019/CVE-2019-7238.yaml
Nuclei TemplatesDeclared conditions
- network: http($.protocol_keys)
- verification: regex,status($.matchers[*].type)
- CVE-2019-7238Exploit
Nexus Repository Manager 3 Remote Code Execution without authentication < 3.15.0
- CVE-2019-7238_Nexus_RCE_ToolExploit
CVE-2019-7238 Nexus RCE漏洞图形化一键检测工具。CVE-2019-7238 Nexus RCE Vul POC Tool.
🐱💻 Poc of CVE-2019-7238 - Nexus Repository Manager 3 Remote Code Execution 🐱💻
- exphubExploit
Exphub[漏洞利用脚本库] 包括Webloigc、Struts2、Tomcat、Nexus、Solr、Jboss、Drupal的漏洞利用脚本，最新添加CVE-2020-14882、CVE-2020-11444、CVE-2020-10204、CVE-2020-10199、CVE-2020-1938、CVE-2020-2551、CVE-2020-2555、CVE-2020-2883、CVE-2019-17558、CVE-2019-6340
- CVE-2019-7238Exploit
RCE
- nexus_rce_CVE-2019-7238Exploit
Some debug notes and exploit(not blind)
- nmap-scriptsExploit
nmap scripts for vuln cve-2020-0796 & cve-2019-7238 & cve2019-11580 & cve2017-6327
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.