Cross-Site Request Forgery in Nexpose by Rapid7
CVE-2017-5264

8.8HIGH

Key Information:

Vendor

Rapid7

Status
Nexpose
Vendor
CVE Published:
14 December 2017

What is CVE-2017-5264?

Nexpose versions earlier than 6.4.66 do not properly validate the source of HTTP requests for the Automated Actions web application. This oversight renders the application vulnerable to cross-site request forgery (CSRF) attacks, where an attacker can trick a user into submitting unwanted requests, potentially compromising sensitive administrative actions.

Affected Version(s)

Nexpose 6.4.65 and prior

References

https://help.rapid7.com/nexpose/en-us/release-notes/archi...
x_refsource_CONFIRM
https://www.exploit-db.com/exploits/43911/
exploitx_refsource_EXPLOIT-DB
http://www.securityfocus.com/bid/102208
vdb-entryx_refsource_BID

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2017-5264 : Cross-Site Request Forgery in Nexpose by Rapid7