CVE-2017-5264: CSRF
Versions of Nexpose prior to 6.4.66 fail to adequately validate the source of HTTP requests intended for the Automated Actions administrative web application, and are susceptible to a cross-site request forgery (CSRF) attack.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2017-5264?
CVE-2017-5264 is a vulnerability found in versions of Nexpose prior to 6.4.66 that fail to adequately validate the source of HTTP requests intended for the Automated Actions administrative web application, making them susceptible to a cross-site request forgery (CSRF) attack.
How does CVE-2017-5264 affect software?
CVE-2017-5264 affects versions of Nexpose prior to 6.4.66.
What is the severity of CVE-2017-5264?
CVE-2017-5264 has a severity keyword of 'high' and a severity value of 8.8.
How can I fix CVE-2017-5264?
To fix CVE-2017-5264, users should update Nexpose to version 6.4.66 or later.
Where can I find more information about CVE-2017-5264?
You can find more information about CVE-2017-5264 at the following references: [SecurityFocus](http://www.securityfocus.com/bid/102208), [Rapid7 Release Notes](https://help.rapid7.com/nexpose/en-us/release-notes/archive/2017/12/#6.4.66), [Exploit-DB](https://www.exploit-db.com/exploits/43911/).