CVE-2019-5630 Rapid7 Nexpose/InsightVM Security Console CSRF

What is CVE-2019-5630?

CVE-2019-5630 is a medium-severity vulnerability in Rapid7 Nexpose/InsightVM Security Console, published on 3 Jul 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A Cross-Site Request Forgery (CSRF) vulnerability was found in Rapid7 Nexpose InsightVM Security Console versions 6.5.0 through 6.5.68. This issue allows attackers to exploit CSRF vulnerabilities on API endpoints using Flash to circumvent a cross-domain pre-flight OPTIONS request.

Weakness: CWE-352

Which versions are affected by CVE-2019-5630?

It affects 1 product.

Products include Rapid7 Nexpose.

How do I fix CVE-2019-5630?

No fix has been published for CVE-2019-5630 yet. Limit exposure of the affected software until one is available.

Is CVE-2019-5630 being exploited?

There is no known exploitation of CVE-2019-5630 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in Rapid7 Nexpose/InsightVM Security Console

• CVE-2017-5264 Cross-site request forgery in Nexpose High 8.8
• CVE-2019-5638 Rapid7 Nexpose Insufficient Session Management High 8.7
• CVE-2017-5243 Weak cryptography in Nexpose hardware appliance High 8.5
• CVE-2017-5232 Other in Nexpose High 7.8
• CVE-2017-5230 Hardcoded credentials in Nexpose High 7.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-p63p-9gq7-hr63.