CVEvulnerability
CVE-2012-6493
6.8 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2014-02-04
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-352
Description
Cross-site request forgery (CSRF) vulnerability in Rapid7 Nexpose Security Console before 5.5.4 allows remote attackers to hijack the authentication of unspecified victims for requests that delete scan data and sites via a request to data/site/delete.
Affected configurations
• rapid7 nexpose (<= 5.5.3)
• rapid7 nexpose 5.4
• rapid7 nexpose 5.4.1
• rapid7 nexpose 5.4.2
• rapid7 nexpose 5.4.3
• rapid7 nexpose 5.4.4
• rapid7 nexpose 5.4.5
• rapid7 nexpose 5.4.6
• rapid7 nexpose 5.4.7
• rapid7 nexpose 5.4.8
• rapid7 nexpose 5.4.9
• rapid7 nexpose 5.4.10
• rapid7 nexpose 5.4.11
• rapid7 nexpose 5.4.12
• rapid7 nexpose 5.5.1
Related
Weakness · CWE (1)
- CWE-352 Cross-Site Request Forgery weakness
References
- http://archives.neohapsis.com/archives/bugtraq/2013-01/0014.html Exploit
- http://osvdb.org/88923 osvdb.org
- http://packetstormsecurity.com/files/119260/Nexpose-Security-Console-Cross-Site-Request-Forgery.html Exploit
- http://www.exploit-db.com/exploits/23924 Exploit
- https://community.rapid7.com/docs/DOC-2155#release1 Patch, Vendor Advisory
- http://archives.neohapsis.com/archives/bugtraq/2013-01/0014.html Exploit
- http://osvdb.org/88923 osvdb.org
- http://packetstormsecurity.com/files/119260/Nexpose-Security-Console-Cross-Site-Request-Forgery.html Exploit
- http://www.exploit-db.com/exploits/23924 Exploit
- https://community.rapid7.com/docs/DOC-2155#release1 Patch, Vendor Advisory