Rapid7 InsightVM versions 6.6.178 and lower suffers from an open redirect vulnerability, whereby an attacker has the ability to redirect the user to a site of the attacker’s choice using the ‘page’ parameter of the ‘data/console/redirect’ component of the application. This issue was resolved in the February, 2023 release of version 6.6.179.
References
| Link | Resource |
|---|---|
| https://docs.rapid7.com/release-notes/nexpose/20230208/ | Release Notes |
Configurations
History
23 Mar 2023, 19:06
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-601 | |
| CPE | cpe:2.3:a:rapid7:insightvm:*:*:*:*:*:*:*:* | |
| CPE | cpe:2.3:a:rapid7:insightvm:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
| References | (MISC) https://docs.rapid7.com/release-notes/nexpose/20230208/ - Release Notes |
20 Mar 2023, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-03-20 20:15
Updated : 2024-02-04 23:37
NVD link : CVE-2023-0681
Mitre link : CVE-2023-0681
CVE.ORG link : CVE-2023-0681
JSON object : View
Products Affected
rapid7
- insightvm
CWE
CWE-601
URL Redirection to Untrusted Site ('Open Redirect')