PT-2022-26502 · Rapid7 · Rapid7 Nexpose+1

Emmett Kelly · Published 2022-12-07 · Updated 2022-12-12 · CVE-2022-4261

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Rapid7 Nexpose and InsightVM versions prior to 6.6.172

Description The issue is related to the failure of Rapid7 Nexpose and InsightVM to reliably validate the authenticity of update contents. This could allow an attacker to provide a malicious update, altering the functionality of Rapid7 Nexpose. The attacker would need a pre-existing mechanism to provide a malicious update, such as through social engineering, privileged access to replace downloaded updates in transit, or by performing an Attacker-in-the-Middle attack on the update service itself.

Recommendations For versions prior to 6.6.172, update to version 6.6.172 or later to resolve the issue. As a temporary workaround, consider restricting access to the update service to minimize the risk of exploitation. Avoid using unverified update sources until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-494

Related Identifiers

CVE-2022-4261

Affected Products

Insightvm

Rapid7 Nexpose

References · 6

• 🔥 https://rapid7.com/blog/post/2022/12/7/cve-2022-4261-rapid7-nexpose-update-validation-issue-fixed · Exploit
• https://docs.rapid7.com/release-notes/insightvm/20221207 · Vendor Advisory
• https://docs.rapid7.com/release-notes/nexpose/20221207 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-4261 · Security Note
• https://osv.dev/vulnerability/CVE-2022-4261 · Vendor Advisory
• https://t.me/cvenotify/39400 · Telegram Post