CVE-2023-5950: Rapid7 Velociraptor Reflected XSS
Rapid7 Velociraptor versions prior to 0.7.0-4 suffer from a reflected cross site scripting vulnerability. This vulnerability allows attackers to inject JS into the error path, potentially leading to unauthorized execution of scripts within a user's web browser. This vulnerability is fixed in version 0.7.0-04 and a patch is available to download. Patches are also available for version 0.6.9 (0.6.9-1).
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-5950?
CVE-2023-5950 is a reflected cross site scripting vulnerability in Rapid7 Velociraptor versions prior to 0.7.0-4.
How does CVE-2023-5950 affect Rapid7 Velociraptor?
CVE-2023-5950 allows attackers to inject JavaScript into the error path of Rapid7 Velociraptor, potentially leading to unauthorized execution of scripts in a user's web browser.
What is the severity of CVE-2023-5950?
CVE-2023-5950 has a severity score of 8.6, which is considered high.
How can I fix CVE-2023-5950?
To fix CVE-2023-5950, update Rapid7 Velociraptor to version 0.7.0-4 or later.
Where can I find more information about CVE-2023-5950?
You can find more information about CVE-2023-5950 at the following link: [https://github.com/Velocidex/velociraptor/releases/tag/v0.7.0](https://github.com/Velocidex/velociraptor/releases/tag/v0.7.0)