CVE-2016-9757: XSS
In the Create Tags page of the Rapid7 Nexpose version 6.4.12 user interface, any authenticated user who has the capability to create tags can inject cross-site scripting (XSS) elements in the tag name field. Once this tag is viewed in the Tag Detail page of the Rapid7 Nexpose 6.4.12 UI by another authenticated user, the script is run in that user's browser context.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-9757?
CVE-2016-9757 has a medium severity rating due to its potential for cross-site scripting attacks.
How do I fix CVE-2016-9757?
To fix CVE-2016-9757, upgrade to Rapid7 Nexpose version 6.4.13 or later.
Who is affected by CVE-2016-9757?
CVE-2016-9757 affects authenticated users of Rapid7 Nexpose version 6.4.12 who can create tags.
What kind of attack does CVE-2016-9757 enable?
CVE-2016-9757 enables cross-site scripting (XSS) attacks through the Tag Name field.
What is the impact of CVE-2016-9757?
The impact of CVE-2016-9757 allows attackers to execute malicious scripts in the context of users viewing the tag.