PT-2016-7817 · Rapid7 · Rapid7 Nexpose

Publicado 2016-12-20 · Atualizado 2016-12-27 · CVE-2016-9757

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Rapid7 Nexpose version 6.4.12

Description The issue allows any authenticated user with the capability to create tags to inject cross-site scripting (XSS) elements in the tag name field on the Create Tags page. When this tag is viewed in the Tag Detail page by another authenticated user, the script is executed in that user's browser context.

Recommendations For Rapid7 Nexpose version 6.4.12, consider restricting access to the tag creation feature to minimize the risk of exploitation until a fix is available. As a temporary workaround, avoid using the tag name field for any input that could be interpreted as script code.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2016-9757

Produtos afetados

Rapid7 Nexpose

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-9757 · Nota de Segurança
• http://securityfocus.com/bid/94996 · Nota
• https://osv.dev/vulnerability/CVE-2016-9757 · Aviso do Fabricante
• https://help.rapid7.com/nexpose/en-us/release-notes/#6.4.13 · Aviso do Fabricante