CVE-2022-3913 Rapid7 Nexpose Certificate Validation Issue

Medium 5.3 Published 1 Feb 2023 Updated 26 Mar 2025

Attacker with network access can bypass TLS certificate validation during updates, potentially intercepting traffic, though code signing prevents malicious package execution.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-3913?

CVE-2022-3913 is a medium-severity vulnerability in Rapid7 InsightVM, published on 1 Feb 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Rapid7 Nexpose and InsightVM versions 6.6.82 through 6.6.177 fail to validate the certificate of the update server when downloading updates. This failure could allow an attacker in a privileged position on the network to provide their own HTTPS endpoint, or intercept communications to the legitimate endpoint. The attacker would need some pre-existing access to at least one node on the network path between the Rapid7-controlled update server and the Nexpose/InsightVM application, and the ability to either spoof the update server's FQDN or redirect legitimate traffic to the attacker's server in order to exploit this vulnerability. Note that even in this scenario, an attacker could not normally replace an update package with a malicious package, since the update process validates a separate, code-signing certificate, distinct from the HTTPS certificate used for communication. This issue was resolved on February 1, 2023 in update 6.6.178 of Nexpose and InsightVM.

Weakness: CWE-295

Which versions are affected by CVE-2022-3913?

It affects 1 product.

Products include Rapid7 Nexpose.

How do I fix CVE-2022-3913?

No fix has been published for CVE-2022-3913 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-3913 being exploited?

There is no known exploitation of CVE-2022-3913 in the wild and no public exploit code.

Sources

Also known as GHSA-v4h7-r9v8-hp3g.