What is CVE-2019-5630?

CVE-2019-5630 is a medium-severity vulnerability in Rapid7 Nexpose, classified under Cross-Site Request Forgery (CSRF). CVSS score: 5.9/10. Published 2019-07-03.

How severe is CVE-2019-5630?

Medium severity. CVSS v3 base score is 5.9 out of 10.

Is CVE-2019-5630 known to be exploited?

5 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

CSRF in Rapid7 Nexpose

CVE-2019-5630

A Cross-Site Request Forgery (CSRF) vulnerability was found in Rapid7 Nexpose InsightVM Security Console versions 6.5.0 through 6.5.68. This issue allows attackers to exploit CSRF vulnerabilities on API endpoints using Flash to circumvent…

Vulnerability class: CSRF (Cross-Site Request Forgery)

EPSS: 0.009 (55.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N.

Affected products

Rapid7 Nexpose
Rapid7 Nexpose/insightvm Security Console — versions 6.5.0 through 6.5.68

Weakness classification (CWE)

CWE-352 — Cross-Site Request Forgery (CSRF)

Public proof-of-concept exploits

References

cve@rapid7.com (x_refsource_CONFIRM, Release Notes, Vendor Advisory)

Frequently asked questions

What is CVE-2019-5630?: CVE-2019-5630 is a medium-severity vulnerability in Rapid7 Nexpose, classified under Cross-Site Request Forgery (CSRF). CVSS score: 5.9/10. Published 2019-07-03.
How severe is CVE-2019-5630?: Medium severity. CVSS v3 base score is 5.9 out of 10.
Is CVE-2019-5630 known to be exploited?: 5 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.