CVE-2022-0758

Published: Mar 17, 2022Modified: Nov 21, 2024

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

Rapid7 Nexpose versions 6.6.129 and earlier suffer from a reflected cross site scripting vulnerability, within the shared scan configuration component of the tool. With this vulnerability an attacker could pass literal values as the test credentials, providing the opportunity for a potential XSS attack. This issue is fixed in Rapid7 Nexpose version 6.6.130.

Affected (1)

Products: Rapid7: Nexpose

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Rapid7 Nexpose	Before 6.6.130

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://docs.rapid7.com/release-notes/nexpose/20220309/

Source: cve@rapid7.com

Release NotesVendor Advisory

https://docs.rapid7.com/release-notes/nexpose/20220309/

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesVendor Advisory

Timeline

No history available yet.