CVE-2023-1699CWE-425

Rapid7 Nexpose Forced Browsing

Medium · published March 30, 2023

CVSS v3.1
4.3
EPSS
0%
Percentile
37.7
In the wild
Unconfirmed
What it is

Rapid7 Nexpose versions 6.6.186 and below suffer from a forced browsing vulnerability.  This vulnerability allows an attacker to manipulate URLs to forcefully browse to and access administrative pages. This vulnerability is fixed in version 6.6.187.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00446 · 37.7th percentile
Weakness
CWE-425 · Direct Request ('Forced Browsing')
Published
2023-03-30T09:26Z
EPSS history
Timeline
  • 30 MAR 09:26Z
    Rapid7 Nexpose Forced Browsing
    cvelistv5