Rapid7 InsightVM versions 6.6.178 and lower suffers from an open redirect vulnerability, whereby an attacker has the ability to redirect the user to a site of the attacker’s choice using the ‘page’ parameter of the ‘data/console/redirect’ component of the application. This issue was resolved in the February, 2023 release of version 6.6.179.
References
| Link | Resource |
|---|---|
| https://docs.rapid7.com/release-notes/nexpose/20230208/ | Release Notes |
| https://docs.rapid7.com/release-notes/nexpose/20230208/ | Release Notes |
Configurations
History
21 Nov 2024, 07:37
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.3 |
| References | () https://docs.rapid7.com/release-notes/nexpose/20230208/ - Release Notes |
07 Nov 2023, 04:01
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | Rapid7 InsightVM versions 6.6.178 and lower suffers from an open redirect vulnerability, whereby an attacker has the ability to redirect the user to a site of the attacker’s choice using the ‘page’ parameter of the ‘data/console/redirect’ component of the application. This issue was resolved in the February, 2023 release of version 6.6.179. |
Information
Published : 2023-03-20 20:15
Updated : 2024-11-21 07:37
NVD link : CVE-2023-0681
Mitre link : CVE-2023-0681
CVE.ORG link : CVE-2023-0681
JSON object : View
Products Affected
rapid7
- insightvm
CWE
CWE-601
URL Redirection to Untrusted Site ('Open Redirect')