PT-2016-7817 · Rapid7 · Rapid7 Nexpose

Published 2016-12-20 · Updated 2016-12-27 · CVE-2016-9757

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Rapid7 Nexpose version 6.4.12

Description The issue allows any authenticated user with the capability to create tags to inject cross-site scripting (XSS) elements in the tag name field on the Create Tags page. When this tag is viewed in the Tag Detail page by another authenticated user, the script is executed in that user's browser context.

Recommendations For Rapid7 Nexpose version 6.4.12, consider restricting access to the tag creation feature to minimize the risk of exploitation until a fix is available. As a temporary workaround, avoid using the tag name field for any input that could be interpreted as script code.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2016-9757

Affected Products

Rapid7 Nexpose

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-9757 · Security Note
• https://osv.dev/vulnerability/CVE-2016-9757 · Vendor Advisory
• https://help.rapid7.com/nexpose/en-us/release-notes/#6.4.13 · Vendor Advisory
• http://securityfocus.com/bid/94996 · Note