PT-2023-17180 · Rapid7 · Rapid7 Nexpose

Casey Cooper · Publicado 2023-03-30 · Atualizado 2023-04-06 · CVE-2023-1699

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rapid7 Nexpose versions 6.6.186 and below

Description This issue allows an attacker to manipulate URLs to forcefully browse to and access administrative pages. The vulnerability is related to forced browsing, which enables unauthorized access to sensitive areas of the system.

Recommendations For versions 6.6.186 and below, update to version 6.6.187 to resolve the issue. As a temporary workaround, consider restricting access to administrative pages until the update can be applied.

Correção

Enumeração de Fraquezas

CWE-425

Identificadores relacionados

CVE-2023-1699

Produtos afetados

Rapid7 Nexpose

Referências · 6

• https://t.me/cvenotify/47155 · Publicação no Telegram
• https://t.me/cvenotify/47704 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-1699 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-1699 · Nota de Segurança
• https://docs.rapid7.com/release-notes/nexpose/20230329 · Nota
• https://t.me/cibsecurity/61166 · Publicação no Telegram