Vulnerability in Rapid7 Insightvm
CVE-2022-4261
Rapid7 Nexpose and InsightVM versions prior to 6.6.172 failed to reliably validate the authenticity of update contents. This failure could allow an attacker to provide a malicious update and alter the functionality of Rapid7 Nexpose. The attacker would need some pre-existing mechanism to provide a malicious update, either through a social engineering effort, privileged access to replace downloaded updates in transit, or by performing an Attacker-in-the-Middle attack on the update service itself.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.4 (Medium). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N.
EPSS exploit prediction
EPSS: 0.003 (24.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 24th percentile — 24.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: +0.000
Affected products
- Rapid7 Insightvm — versions 0
- Rapid7 Nexpose — versions 0
Weakness classification (CWE)
References
- docs.rapid7.com/release-notes/nexpose/20221207/ (Release Notes, Vendor Advisory)
- www.rapid7.com/blog/post/2022/12/7/cve-2022-4261-rapid7-nexpose-update-validati… (Exploit, Mitigation, Vendor Advisory)
- docs.rapid7.com/release-notes/insightvm/20221207/ (Release Notes, Vendor Advisory)
Frequently asked questions
- What is CVE-2022-4261?
- CVE-2022-4261 is a medium-severity vulnerability in Rapid7 Insightvm, classified under Download of Code Without Integrity Check. CVSS score: 4.4/10. Published 2022-12-08.
- How severe is CVE-2022-4261?
- Medium severity. CVSS v3 base score is 4.4 out of 10.