Login Request a demo
Unscored severity · published Feb 4, 2014
CVE-2012-6493
Cross-site request forgery (CSRF) vulnerability in Rapid7 Nexpose Security Console before 5.5.4 allows remote attackers to hijack the authentication of unspecified victims for…
–
CVSS
2.3%
EPSS
No
On KEV
Description
Cross-site request forgery (CSRF) vulnerability in Rapid7 Nexpose Security Console before 5.5.4 allows remote attackers to hijack the authentication of unspecified victims for requests that delete scan data and sites via a request to data/site/delete.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
Nexpose · Rapid7
through 5.5.3; 5.4; 5.4.1; 5.4.2; 5.4.3; 5.4.4; +9 more · source: NVD
Affected product
NE
Nexpose
Rapid7
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-6493
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-6493
Exploit
http://archives.neohapsis.com/archives/bugtraq/2013-01/0014.html
osvdb.org
http://osvdb.org/88923
Exploit
http://packetstormsecurity.com/files/119260/Nexpose-Security-Console-Cross-Site-Request-Forgery.html
Exploit
http://www.exploit-db.com/exploits/23924
Patch
https://community.rapid7.com/docs/DOC-2155#release1
More from Nexpose
9.8
CVE-2023-1699
Rapid7 Nexpose versions 6.6.186 and below suffer from a forced browsing vulnerability.  This vulnerability allows an attacker to manipulate URLs to forcefully browse to and access…
8.8
CVE-2022-0757
Rapid7 Nexpose versions 6.6.93 and earlier are susceptible to an SQL Injection vulnerability, whereby valid search operators are not defined
8.8
CVE-2019-5630
A Cross-Site Request Forgery (CSRF) vulnerability was found in Rapid7 Nexpose InsightVM Security Console versions 6.5.0 through 6.5.68
8.8
CVE-2017-5264
Versions of Nexpose prior to 6.4.66 fail to adequately validate the source of HTTP requests intended for the Automated Actions administrative web application, and are susceptible…
8.7
CVE-2019-5638
Rapid7 Nexpose versions 6.5.50 and prior suffer from insufficient session expiration when an administrator performs a security relevant edit on an existing, logged on user