A high-severity session management vulnerability in Sonatype Nexus Repository 3 could allow unauthorized access by failing to revoke active sessions after user account modifications.

The software suffers from insufficient session expiration (CWE-613), which occurs because the application does not properly terminate sessions or flush cached permissions when an account status changes. This flaw requires the attacker to have an existing authenticated session, which remains active despite subsequent administrative actions to disable the account or change credentials.

The ability for a compromised or revoked account to maintain access to the repository poses a significant risk to data integrity and system security. With a CVSS score of 8.7, this vulnerability facilitates unauthorized persistence, potentially allowing an attacker to bypass security measures and access sensitive build artifacts or configuration data. This could lead to severe consequences, including supply chain compromise or unauthorized modification of internal software components.

Immediate Action: Update Sonatype Nexus Repository 3 to version 3.95.0 or later to ensure session termination logic is correctly applied.

Proactive Monitoring: Review session management logs for unusual login patterns and ensure that administrative actions against user accounts are verified for effectiveness.

Compensating Controls: If immediate patching is not feasible, manually terminate all active sessions for any account that has been deactivated or had its password changed.

Public Exploit Available: No (exploit_available: false)

Given the high CVSS score and the potential for unauthorized persistence, organizations should prioritize the update to version 3.95.0. Immediate remediation is necessary to close this session management gap and ensure that administrative changes to user accounts are enforced across all active sessions.