CVE-2017-5264 EXPLOIT
8.8
HIGH · CVSS 3.0 · EPSS 2.7% (pctl 86)
Patch early
A public exploit exists.
Description
Versions of Nexpose prior to 6.4.66 fail to adequately validate the source of HTTP requests intended for the Automated Actions administrative web application, and are susceptible to a cross-site request forgery (CSRF) attack.
Scoring
| CVSS | 8.8 (HIGH, v3.0) |
|---|---|
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| EPSS | 2.75% — more likely to be exploited than 86% of all CVEs |
| Weakness | CWE-352 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2017-12-14 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| rapid7 | nexpose |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Nexpose < 6.4.66 - Cross-Site Request Forgery | 2018-01-28 |
References
- http://www.securityfocus.com/bid/102208
- https://help.rapid7.com/nexpose/en-us/release-notes/archive/2017/12/#6.4.66
- https://www.exploit-db.com/exploits/43911/
- http://www.securityfocus.com/bid/102208
- https://help.rapid7.com/nexpose/en-us/release-notes/archive/2017/12/#6.4.66
- https://www.exploit-db.com/exploits/43911/
→ the Explorer · watch your stack · NVD