Technical impact
Sonatype Nexus Repository Manager contains an authorization flaw in the proxy repository configuration that permits a delegated repository administrator to read the stored upstream proxy credentials. The vulnerability, classified as CWE‑863, can lead to accidental exposure of authentication data that could be reused to compromise upstream repositories or their services.
Affected Systems
All Sonatype Nexus Repository Manager releases earlier than version 3.93.0 are affected, encompassing the majority of installations from the 3.x series such as 3.18.x through 3.92.x. Any deployment that has not applied the update to 3.93.0 or later remains vulnerable.
Risk and Exploitability
The CVSS score of 5.9 indicates a moderate impact, and the EPSS score of less than 1 % suggests a low likelihood of exploitation. The vulnerability is not listed in CISA KEV. Exploitation requires authenticated access with delegated repository‑administrator rights; an insider or compromised account could leverage this to retrieve upstream credentials without triggering obvious alerts, potentially enabling lateral movement or compromise of external services.
