CVE-2022-0758CWE-79

Rapid7 Nexpose Reflected XSS

Low · published March 17, 2022

CVSS v3.1
3.3
EPSS
0%
Percentile
35.9
In the wild
Unconfirmed
What it is

Rapid7 Nexpose versions 6.6.129 and earlier suffer from a reflected cross site scripting vulnerability, within the shared scan configuration component of the tool. With this vulnerability an attacker could pass literal values as the test credentials, providing the opportunity for a potential XSS attack. This issue is fixed in Rapid7 Nexpose version 6.6.130.

The record
Technical detail
CVSS v3.1
3.3 · LOW
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00427 · 35.9th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2022-03-17T22:30Z
EPSS history
Timeline
  • 17 MAR 22:30Z
    Rapid7 Nexpose Reflected XSS
    cvelistv5