Sonatype Nexus Repository 3 versions including 3.0.0 have a SSRF vulnerability (CWE-918) due to lack of validation on the destination URL configured in the "Webhook: Global" capability. This allows users with Capability Administration permission to cause the server to send HTTP requests to arbitrary internal network locations. Since the permission is assigned by role and independent of authentication, an unauthenticated user could potentially exploit this if the anonymous role has the permission. The CVSS 4.0 base score is 5.1 (medium severity), reflecting network attack vector, low complexity, no user interaction, and limited impact on integrity and availability. No official patch or remediation level has been published by the vendor as of the data provided.

An attacker with Capability Administration permission can exploit this SSRF vulnerability to make the Nexus Repository server send HTTP requests to internal network resources. This could potentially be used to access or interact with internal services not otherwise accessible externally. Because the permission can be assigned to the anonymous role, unauthenticated attackers might trigger this behavior if the server is misconfigured. The impact is limited to information disclosure or interaction with internal systems via SSRF; no direct integrity or availability impact is indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and restrict the assignment of the Capability Administration permission, especially ensuring it is not granted to the anonymous role. Validate and restrict the URLs configured for the "Webhook: Global" capability to trusted destinations to prevent SSRF exploitation.