CVE-2025-9868CWE-918ssrf

CVE-2025-9868

published October 8, 2025

CVSS

8.7

EPSS

Percentile

41.6

In the wild

Unconfirmed

What it is

Server-Side Request Forgery (SSRF) in the Remote Browser Plugin in Sonatype Nexus Repository 2.x up to and including 2.15.2 allows unauthenticated remote attackers to exfiltrate proxy repository credentials via crafted HTTP requests.

The record

Technical detail

CVSS: 8.7 · NONE
CVSS v4.0: Not supplied
EPSS: 0.00495 · 41.6th percentile
Weakness: CWE-918 · Server-Side Request Forgery (SSRF)
Published: 2025-10-08T22:15Z

References (1)

https://support.sonatype.com/hc/en-us/articles/45363201583635 · 103e4ec9-0a87-450b-af77-479448ddef11

EPSS history

Timeline

08 OCT 17:07Z
Nexus Repository 2 - SSRF Vulnerability in Remote Browser Plugin
cvelistv5