CVE-2012-6493 Cross-site request forgery in n/a

What is CVE-2012-6493?

CVE-2012-6493 is a medium-severity vulnerability in n/a, published on 4 Feb 2014. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Cross-site request forgery (CSRF) vulnerability in Rapid7 Nexpose Security Console before 5.5.4 allows remote attackers to hijack the authentication of unspecified victims for requests that delete scan data and sites via a request to data/site/delete.

Weakness: CWE-352

Which versions are affected by CVE-2012-6493?

It affects 1 product.

Products include Rapid7 Nexpose.

How do I fix CVE-2012-6493?

No fix has been published for CVE-2012-6493 yet. Limit exposure of the affected software until one is available.

Is CVE-2012-6493 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2012-6493 exists.

Public exploit code: 1 Exploit-DB entry.

Other vulnerabilities in n/a

• CVE-2017-5264 Cross-site request forgery in Nexpose High 8.8
• CVE-2019-5638 Rapid7 Nexpose Insufficient Session Management High 8.7
• CVE-2017-5243 Weak cryptography in Nexpose hardware appliance High 8.5
• CVE-2017-5232 Other in Nexpose High 7.8
• CVE-2017-5230 Hardcoded credentials in Nexpose High 7.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2q79-mpxf-8x5p.