Rapid7 Nexpose and InsightVM versions prior to 6.6.172 failed to reliably validate the authenticity of update contents. This failure could allow an attacker to provide a malicious update and alter the functionality of Rapid7 Nexpose. The attacker would need some pre-existing mechanism to provide a malicious update, either through a social engineering effort, privileged access to replace downloaded updates in transit, or by performing an Attacker-in-the-Middle attack on the update service itself.
References
| Link | Resource |
|---|---|
| https://docs.rapid7.com/release-notes/insightvm/20221207/ | Release Notes Vendor Advisory |
| https://docs.rapid7.com/release-notes/nexpose/20221207/ | Release Notes Vendor Advisory |
| https://www.rapid7.com/blog/post/2022/12/7/cve-2022-4261-rapid7-nexpose-update-validation-issue-fixed | Exploit Mitigation Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
07 Nov 2023, 03:57
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | Rapid7 Nexpose and InsightVM versions prior to 6.6.172 failed to reliably validate the authenticity of update contents. This failure could allow an attacker to provide a malicious update and alter the functionality of Rapid7 Nexpose. The attacker would need some pre-existing mechanism to provide a malicious update, either through a social engineering effort, privileged access to replace downloaded updates in transit, or by performing an Attacker-in-the-Middle attack on the update service itself. |
Information
Published : 2022-12-08 00:15
Updated : 2024-02-28 19:51
NVD link : CVE-2022-4261
Mitre link : CVE-2022-4261
CVE.ORG link : CVE-2022-4261
JSON object : View
Products Affected
rapid7
- nexpose
- insightvm
CWE
CWE-494
Download of Code Without Integrity Check