The vulnerability is a Server‑Side Request Forgery (SSRF) that occurs when an authenticated administrator configures a proxy repository with an arbitrary URL. The system fails to validate whether that URL points into the private network or to cloud metadata services, allowing the attacker to force the server to connect to unintended locations. Successful exploitation can expose internal IP addresses, download sensitive data, or retrieve cloud instance metadata, effectively leaking secrets and enabling further attacks.

Affected customers are those running Sonatype Nexus Repository 3, versions 3.0.0 through at least 3.9.0. All 3.x releases listed in the provided data are impacted, so any deployment of Nexus Repository 3 that has not been upgraded beyond the affected range is vulnerable.

The CVSS score of 6.2 classifies the flaw as medium severity, and the EPSS score of less than 1 % indicates a low probability of exploitation at this time. The vulnerability is not currently in the CISA KEV list. Potential attackers would need administrator credentials to modify proxy settings, and the action would involve adding a URL that points to an internal host or a cloud metadata endpoint. Mitigation is available through an upgrade to 3.88.0 or later, or by enabling private network validation to block proxy repositories from accessing private destinations.