Nexus Repository 3 hosts a Server‑Side Request Forgery (SSRF) flaw in its email configuration verification endpoint. An attacker who possesses the nexus:settings:update permission can provide arbitrary host and port values, causing the server to initiate outbound connections. By comparing the server’s responses to different attempts, the attacker can determine whether internal hosts and ports are reachable, effectively performing network enumeration. The vulnerability does not directly allow arbitrary code execution or data exfiltration, but it does expose information about the internal network topology.

The flaw affects Sonatype Nexus Repository 3 Community Edition and Pro deployments with versions up to and including 3.94.1. All releases prior to 3.95.0 are vulnerable regardless of license tier; the issue is resolved in 3.95.0 and later.

The CVSS score of 5.1 indicates moderate severity. EPSS information is unavailable and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread active exploitation has been reported. Attackers need access to a user with nexus:settings:update rights, typically an administrator. If such privileges are compromised or widely distributed, the SSRF can be leveraged to map internal resources and potentially facilitate subsequent attacks. Thus, environments with loosely protected administrative permissions face moderate to high risk, while tightly controlled deployments pose lower risk.