PT-2022-4190 · Rapid7 · Rapid7 Nexpose

Aleksey Solovev · Published 2022-03-17 · Updated 2022-05-31 · CVE-2022-0758

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Rapid7 Nexpose versions 6.6.129 and earlier

Description The issue is a reflected cross site scripting vulnerability within the shared scan configuration component of the tool. This allows an attacker to pass literal values as the test credentials, providing the opportunity for a potential XSS attack. The vulnerability exists due to inadequate protection of the web page structure, which could enable a remote attacker to conduct an XSS attack.

Recommendations For Rapid7 Nexpose versions 6.6.129 and earlier, update to version 6.6.130 to resolve the issue. As a temporary workaround, consider restricting access to the shared scan configuration component to minimize the risk of exploitation. Avoid using literal values as test credentials in the affected component until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2022-05038

CVE-2022-0758

Affected Products

Rapid7 Nexpose

References · 6

• https://docs.rapid7.com/release-notes/nexpose/20220309 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-0758 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0758 · Security Note
• https://bdu.fstec.ru/vul/2022-05038 · Security Note
• https://t.me/ptswarm/117 · Telegram Post
• https://t.me/cibsecurity/39180 · Telegram Post