CVEvulnerability

CVE-2016-9757

5.4 MEDIUM Published 2016-12-20 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2016-12-20
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
5.4 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0 ([email protected])
3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
Weaknesses
CWE-79

Description

In the Create Tags page of the Rapid7 Nexpose version 6.4.12 user interface, any authenticated user who has the capability to create tags can inject cross-site scripting (XSS) elements in the tag name field. Once this tag is viewed in the Tag Detail page of the Rapid7 Nexpose 6.4.12 UI by another authenticated user, the script is run in that user's browser context.

Affected configurations

• rapid7 nexpose 6.4.12

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References