# CVE-2019-7238: Sonatype Nexus Repository Manager Incorrect Access Control Vulnerability

Source: https://junglewise.ai/threats/cve-2019-7238-sonatype-nexus-repository-manager-incorrect-access-control  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-12-10. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2019-7238 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2021-12-10

Sonatype Nexus Repository Manager 3 versions prior to 3.15.0 contain an incorrect access control vulnerability. This flaw allows unauthenticated remote attackers to execute arbitrary code on the server.

Technologies: [Sonatype Nexus Repository Manager](https://junglewise.ai/threats/technologies/nexus-repository-manager). Vendors: [Sonatype](https://junglewise.ai/threats/vendors/sonatype).

## Quick answers

**Is CVE-2019-7238 exploited in the wild?** Yes. CVE-2019-7238 is known to be exploited in the wild, first recorded on 10 December 2021. Treat it as urgent.

**How severe is CVE-2019-7238?** Critical severity, with a CVSS score of 9.8, published 10 December 2021.

**Which products and versions are affected?** Sonatype Nexus Repository Manager 3 3.0.0 to 3.14.1.

**Is there a fix for CVE-2019-7238?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2019-7238 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2019-7238?** Check whether you run Sonatype Nexus Repository Manager. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Sonatype Nexus Repository Manager 3 3.0.0 to 3.14.1

## Timeline

- 2019-02-05: disclosed: Vendor advisory published by Sonatype
- 2019-03-21: disclosed: NVD Published Date
- 2021-12-10: kev added: Added to CISA Known Exploited Vulnerabilities Catalog

## Related threats

- [Sonatype Nexus Repository authorization bypass in blobstore management](https://junglewise.ai/threats/cve-2026-77125-sonatype-nexus-repository-authorization-bypass-in-blobstore)
- [Sonatype Nexus Repository privilege escalation in script execution](https://junglewise.ai/threats/cve-2026-77124-sonatype-nexus-repository-privilege-escalation-in-script)
- [Sonatype Nexus Repository 3 sensitive information disclosure in capability API](https://junglewise.ai/threats/cve-2026-77123-sonatype-nexus-repository-3-sensitive-information-disclosure-in)
- [Sonatype Nexus Repository authorization bypass in REST API](https://junglewise.ai/threats/cve-2026-77122-sonatype-nexus-repository-authorization-bypass-in-rest-api)
- [Nexus Repository 3 did not sufficiently restrict which HikariCP connection-pool properties could be set through the…](https://junglewise.ai/threats/cve-2026-17603-nexus-repository-3-did-not-sufficiently-restrict-which-hikaricp)