Sonatype Nexus Repository 3 version 3.0.0 contains an SSRF vulnerability (CWE-918) where the "Webhook: Global" capability's configured URL is not validated before the server issues outbound HTTP requests. This allows users with Capability Administration permission, which can be assigned via roles and may include unauthenticated users if the anonymous role has the permission, to cause the server to send requests to internal network locations. This could potentially be used to access or interact with internal resources that are otherwise inaccessible externally.

An attacker with Capability Administration permission can induce the Nexus Repository server to send arbitrary HTTP requests to internal network locations, potentially accessing or interacting with internal services. Because the permission can be granted to unauthenticated users via role assignment, the vulnerability could be exploited without authentication if the anonymous role is misconfigured. The CVSS 4.0 base score is 5.1 (medium severity), reflecting network attack vector, low complexity, no user interaction, and limited impact on integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and restrict the assignment of the Capability Administration permission, especially ensuring that the anonymous role does not have this permission. Limit exposure by validating and controlling webhook URLs configured in the system to prevent SSRF exploitation.