CVE-2019-5630: Rapid7 Nexpose/InsightVM Security Console CSRF

Q: What is the vulnerability ID of this CSRF vulnerability?

The vulnerability ID of this CSRF vulnerability is CVE-2019-5630.

Q: What is the affected software?

The affected software is Rapid7 Nexpose InsightVM Security Console versions 6.5.0 through 6.5.68.

Q: How severe is this vulnerability?

This vulnerability has a severity rating of 8.8 (high).

Q: How can attackers exploit this CSRF vulnerability?

Attackers can exploit this CSRF vulnerability by using Flash to circumvent a cross-domain pre-flight OPTIONS request on API endpoints.

Q: Is there a fix available for this vulnerability?

Yes, a fix is available for this vulnerability. Users should update to Rapid7 Nexpose InsightVM Security Console version 6.5.69 or later.

Published Jul 3, 2019

Updated

A Cross-Site Request Forgery (CSRF) vulnerability was found in Rapid7 Nexpose InsightVM Security Console versions 6.5.0 through 6.5.68. This issue allows attackers to exploit CSRF vulnerabilities on API endpoints using Flash to circumvent a cross-domain pre-flight OPTIONS request.

Affected Software

1 affected component

Rapid7 Nexpose>=6.5.0<=6.5.68

Remediation

Information

This issue minimally affects Security Console versions 6.5.0 through 6.5.68. If your Security Console currently falls on or within this affected version range, ensure that you update your Security Console to 6.5.69 (or later if available).

Event History

Jul 3, 2019

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is the vulnerability ID of this CSRF vulnerability?

The vulnerability ID of this CSRF vulnerability is CVE-2019-5630.

What is the affected software?

The affected software is Rapid7 Nexpose InsightVM Security Console versions 6.5.0 through 6.5.68.

How severe is this vulnerability?