CVE-2022-4261: Rapid7 Nexpose Update Validation Issue
Rapid7 · Nexpose
Vendor fix available · Affected: Rapid7 Nexpose · Exploitation: unlikely (under 1%)
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 26% of scored CVEs
DescriptionCVE.org
Rapid7 Nexpose and InsightVM versions prior to 6.6.172 failed to reliably validate the authenticity of update contents. This failure could allow an attacker to provide a malicious update and alter the functionality of Rapid7 Nexpose. The attacker would need some pre-existing mechanism to provide a malicious update, either through a social engineering effort, privileged access to replace downloaded updates in transit, or by performing an Attacker-in-the-Middle attack on the update service itself.
Affected products2
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- Rapid7 · Nexposeup to and including 6.6.171
- Rapid7 · InsightVMup to and including 6.6.171
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Unlikely (under 1%). EPSS under 1%, or no score yet.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Vendor
- Rapid7
- Published
- December 2022
CoverageNo articles yet
No CyberSIXT article names CVE-2022-4261 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.