CVE-2017-5264: CSRF
First published: Thu Dec 14 2017(Updated: )
Versions of Nexpose prior to 6.4.66 fail to adequately validate the source of HTTP requests intended for the Automated Actions administrative web application, and are susceptible to a cross-site request forgery (CSRF) attack.
Credit: cve@rapid7.con
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Rapid7 Nexpose | <6.4.66 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2017-5264?
CVE-2017-5264 is a vulnerability found in versions of Nexpose prior to 6.4.66 that fail to adequately validate the source of HTTP requests intended for the Automated Actions administrative web application, making them susceptible to a cross-site request forgery (CSRF) attack.
How does CVE-2017-5264 affect software?
CVE-2017-5264 affects versions of Nexpose prior to 6.4.66.
What is the severity of CVE-2017-5264?
CVE-2017-5264 has a severity keyword of 'high' and a severity value of 8.8.
How can I fix CVE-2017-5264?
To fix CVE-2017-5264, users should update Nexpose to version 6.4.66 or later.
Where can I find more information about CVE-2017-5264?
You can find more information about CVE-2017-5264 at the following references: [SecurityFocus](http://www.securityfocus.com/bid/102208), [Rapid7 Release Notes](https://help.rapid7.com/nexpose/en-us/release-notes/archive/2017/12/#6.4.66), [Exploit-DB](https://www.exploit-db.com/exploits/43911/).
- collector/nvd-index
- agent/weakness
- agent/severity
- agent/references
- agent/author
- agent/description
- agent/type
- agent/event
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/rapid7
- canonical/rapid7 nexpose