CVE-2019-5630

Rapid7 Nexpose/InsightVM Security Console CSRF

Medium · published July 3, 2019

CVSS v3.0
5.9
EPSS
1%
Percentile
59.0
In the wild
Unconfirmed
What it is

A Cross-Site Request Forgery (CSRF) vulnerability was found in Rapid7 Nexpose InsightVM Security Console versions 6.5.0 through 6.5.68. This issue allows attackers to exploit CSRF vulnerabilities on API endpoints using Flash to circumvent a cross-domain pre-flight OPTIONS request.

The record
Technical detail
CVSS v3.0
5.9 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00890 · 59.0th percentile
Published
2019-07-03T17:00Z
EPSS history
Timeline
  • 03 JUL 17:00Z
    Rapid7 Nexpose/InsightVM Security Console CSRF
    cvelistv5