{"id":"CVE-2025-9868","title":"Server-Side Request Forgery (SSRF) in the Remote Browser Plugin in Sonatype Nexus Repository 2.x up to and including 2.15.2 allows unauthenticated remote attackers to exfiltrate proxy repository credentials via crafted HTTP requests.","summary":"Server-Side Request Forgery (SSRF) in the Remote Browser Plugin in Sonatype Nexus Repository 2.x up to and including 2.15.2 allows unauthenticated remote attackers to exfiltrate proxy repository credentials via crafted HTTP requests.","severity":"none","cwe":["CWE-918"],"published":"2025-10-08","updated":"2026-09-26","sourceUpdated":"2026-09-26T00:10:00.127","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-9868","references":[{"url":"https://support.sonatype.com/hc/en-us/articles/45363201583635","label":"103e4ec9-0a87-450b-af77-479448ddef11"}],"tags":["nvd"],"epss":0.00495,"epssPercentile":0.39924,"ingestedAt":"2026-09-26T00:22:39.960Z","slug":"CVE-2025-9868","body":"## Overview\n\nServer-Side Request Forgery (SSRF) in the Remote Browser Plugin in Sonatype Nexus Repository 2.x up to and including 2.15.2 allows unauthenticated remote attackers to exfiltrate proxy repository credentials via crafted HTTP requests.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}