Weak Encryption in Rapid7 Nexpose's Java Keystore

CVE-2017-5230

What is CVE-2017-5230?

Rapid7 Nexpose's Java keystore across all versions before 6.4.50 uses a static, non-modifiable password, making stored scan credentials vulnerable to exposure. This design flaw compromises the security of stored credentials, as users are unable to change the default encryption password, thus potentially allowing unauthorized access to sensitive information.

References