PT-2017-16405 · Rapid7+1 · Rapid7 Nexpose+1

Publicado 2017-03-02 · Atualizado 2017-08-15 · CVE-2017-5230

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rapid7 Nexpose versions prior to 6.4.50

Description The Java keystore in Rapid7 Nexpose uses a static, unmodifiable password for encryption, which may compromise the security of saved scan credentials stored in the keystore.

Recommendations For versions prior to 6.4.50, update to version 6.4.50 or later to address the issue with the static password used for the Java keystore encryption.

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2017-5230

Produtos afetados

Java

Rapid7 Nexpose

Referências · 5

• https://community.rapid7.com/community/infosec/blog/2017/03/01/multiple-vulnerabilities-affecting-four-rapid7-products · Aviso do Fabricante
• https://help.rapid7.com/nexpose/en-us/release-notes/#6.4.50 · Nota
• http://securityfocus.com/bid/96956 · Nota
• https://osv.dev/vulnerability/CVE-2017-5230 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-5230 · Nota de Segurança