PT-2017-16407 · Rapid7 · Nexpose

Publicado 2017-03-02 · Atualizado 2017-03-21 · CVE-2017-5232

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rapid7 Nexpose versions prior to 6.4.24

Description The issue concerns a DLL preloading vulnerability. This means that the installer can potentially load a malicious DLL if it is located in the current working directory of the installer.

Recommendations For versions prior to 6.4.24, update to version 6.4.24 or later to resolve the issue.

Correção

Untrusted Search Path

Enumeração de Fraquezas

CWE-426

Identificadores relacionados

CVE-2017-5232

Produtos afetados

Nexpose

Referências · 4

• https://osv.dev/vulnerability/CVE-2017-5232 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-5232 · Nota de Segurança
• https://community.rapid7.com/community/infosec/blog/2017/03/01/multiple-vulnerabilities-affecting-four-rapid7-products · Aviso do Fabricante
• http://securityfocus.com/bid/96956 · Nota