CVE-2019-7238

highpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.766 · 100 %ileexploit · PoCEURUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 7 exploits · PoC

Likely / severe?

76.6% (100th) EPSS

CVSS 7.5 · high

Is it mine?

3 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · nvd

added 2021-12-10remediate by 2022-06-10

required action Apply updates per vendor instructions.

EPSS · scored 2026-10-27

Sonatype Nexus Repository Manager Incorrect Access Control Vulnerability

Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control.

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.5–9.8

v2.07.5highAV:N/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 10 · impact 6.4

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9

v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondaryexploitability 3.9 · impact 5.9

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-269US

exploits (7)

Public proof-of-concept and weaponised exploit code.

CyberCTF/vulhub-nexus-cve-2019-7238Vulhub nexus/CVE-2019-7238: Nexus Repository Manager 3 JEXL Injection RCE (CVE-2019-7238), run with IsoloomPoC · poc_in_github
DannyRavi/nmap-scriptsnmap scripts for vuln cve-2020-0796 & cve-2019-7238 & cve2019-11580 & cve2017-6327 PoC · poc_in_github
jas502n/CVE-2019-7238Nexus Repository Manager 3 Remote Code Execution without authentication < 3.15.0PoC · poc_in_github
magicming200/CVE-2019-7238_Nexus_RCE_ToolCVE-2019-7238 Nexus RCE漏洞图形化一键检测工具。CVE-2019-7238 Nexus RCE Vul POC Tool.PoC · poc_in_github
mpgn/CVE-2019-7238🐱‍💻 Poc of CVE-2019-7238 - Nexus Repository Manager 3 Remote Code Execution 🐱‍💻PoC · poc_in_github
smallpiggy/CVE-2019-7238RCEPoC · poc_in_github

affected products (3)

Products and version ranges known to be affected.

n/a n/a≤ n/aenisa_euvdEU
Sonatype Inc. Nexus Repository Manager≤ 3.15.0fstec_bduRU
sonatype nexus repository manager3.0.0 → 3.15.0nvdUScpe:2.3:a:sonatype:nexus_repository_manager:*:*:*:*:*:*:*:*

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu nvd NVD CVE.org MITRE

published 2019-03-21modified 2026-06-17

references (7)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan