CVE-2012-6493

Опубликовано: 04 фев. 2014

Источник: nvd

CVSS2: 6.8

EPSS Низкий

Описание

Cross-site request forgery (CSRF) vulnerability in Rapid7 Nexpose Security Console before 5.5.4 allows remote attackers to hijack the authentication of unspecified victims for requests that delete scan data and sites via a request to data/site/delete.

Ссылки

http://archives.neohapsis.com/archives/bugtraq/2013-01/0014.html
Exploit
http://osvdb.org/88923
http://packetstormsecurity.com/files/119260/Nexpose-Security-Console-Cross-Site-Request-Forgery.html
Exploit
http://www.exploit-db.com/exploits/23924
Exploit
https://community.rapid7.com/docs/DOC-2155#release1
Patch
Vendor Advisory
http://archives.neohapsis.com/archives/bugtraq/2013-01/0014.html
Exploit
http://osvdb.org/88923
http://packetstormsecurity.com/files/119260/Nexpose-Security-Console-Cross-Site-Request-Forgery.html
Exploit
http://www.exploit-db.com/exploits/23924
Exploit
https://community.rapid7.com/docs/DOC-2155#release1
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:rapid7:nexpose:*:*:*:*:*:*:*:*

Версия до 5.5.3 (включая)

cpe:2.3:a:rapid7:nexpose:5.4:*:*:*:*:*:*:*

cpe:2.3:a:rapid7:nexpose:5.4.1:*:*:*:*:*:*:*

cpe:2.3:a:rapid7:nexpose:5.4.2:*:*:*:*:*:*:*

cpe:2.3:a:rapid7:nexpose:5.4.3:*:*:*:*:*:*:*

cpe:2.3:a:rapid7:nexpose:5.4.4:*:*:*:*:*:*:*

cpe:2.3:a:rapid7:nexpose:5.4.5:*:*:*:*:*:*:*

cpe:2.3:a:rapid7:nexpose:5.4.6:*:*:*:*:*:*:*

cpe:2.3:a:rapid7:nexpose:5.4.7:*:*:*:*:*:*:*

cpe:2.3:a:rapid7:nexpose:5.4.8:*:*:*:*:*:*:*

cpe:2.3:a:rapid7:nexpose:5.4.9:*:*:*:*:*:*:*

cpe:2.3:a:rapid7:nexpose:5.4.10:*:*:*:*:*:*:*

cpe:2.3:a:rapid7:nexpose:5.4.11:*:*:*:*:*:*:*

cpe:2.3:a:rapid7:nexpose:5.4.12:*:*:*:*:*:*:*

cpe:2.3:a:rapid7:nexpose:5.5.1:*:*:*:*:*:*:*

EPSS

Процентиль: 59%

0.00385

Низкий

6.8 Medium

CVSS2

Дефекты

CWE-352

Связанные уязвимости

GHSA-2q79-mpxf-8x5p

github

больше 3 лет назад