CVE-2022-0758

Rapid7 Nexpose Reflected XSS

State: Published
Severity: 3.3 Low
Published: Mar 17, 2022
Updated: Sep 16, 2024
Reserved: Feb 24, 2022

Description

Rapid7 Nexpose versions 6.6.129 and earlier suffer from a reflected cross site scripting vulnerability, within the shared scan configuration component of the tool. With this vulnerability an attacker could pass literal values as the test credentials, providing the opportunity for a potential XSS attack. This issue is fixed in Rapid7 Nexpose version 6.6.130.

Scores

CVSS	Score	Vector	Source
3.1	3.3 Low	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	rapid7

Weaknesses

CWE-79 Cross-site Scripting (XSS)

Affected Products

Product	Versions
NexposeRapid7	6.6.129 through 6.6.129Affected

References

https://docs.rapid7.com/release-notes/nexpose/20220309/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.