{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2022-3913 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2022-3913 yet. Limit exposure of the affected software until one is available.","what":"CVE-2022-3913 is a medium-severity vulnerability in Rapid7 InsightVM, published on 1 Feb 2023. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2022-3913 and fix it if it is affected.\n\nWhat it is: CVE-2022-3913 is a medium-severity vulnerability in Rapid7 InsightVM, published on 1 Feb 2023. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2022-3913 in the wild and no public exploit code.\n\nAffected product: Rapid7 InsightVM. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2022-3913/ (Markdown: https://insights.sbomify.com/CVE-2022-3913/index.md)","id":"CVE-2022-3913","markdown":"https://insights.sbomify.com/CVE-2022-3913/index.md","name":"CVE-2022-3913","record":{"aliases":["GHSA-v4h7-r9v8-hp3g"],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["security_bypass"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Vulnerability Management Server","requires_auth":"none","summary":"Attacker with network access can bypass TLS certificate validation during updates, potentially intercepting traffic, though code signing prevents malicious package execution.","user_interaction":"not_required","vuln_class":"security_feature_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"rapid7","cpe":[{"product":"nexpose","vendor":"rapid7"}],"cvss":{"score":5.3,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"cwes":[{"id":"CWE-295","name":"Improper Certificate Validation"}],"description":"Rapid7 Nexpose and InsightVM versions 6.6.82 through 6.6.177 fail to validate the certificate of the update server when downloading updates. This failure could allow an attacker in a privileged position on the network to provide their own HTTPS endpoint, or intercept communications to the legitimate endpoint. The attacker would need some pre-existing access to at least one node on the network path between the Rapid7-controlled update server and the Nexpose/InsightVM application, and the ability to either spoof the update server's FQDN or redirect legitimate traffic to the attacker's server in order to exploit this vulnerability. Note that even in this scenario, an attacker could not normally replace an update package with a malicious package, since the update process validates a separate, code-signing certificate, distinct from the HTTPS certificate used for communication. This issue was resolved on February 1, 2023 in update 6.6.178 of Nexpose and InsightVM.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":null,"headline":"Rapid7 Nexpose Certificate Validation Issue","id":"CVE-2022-3913","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"security_feature_bypass","year":"2022"},"n_packages":0,"n_references":2,"next":{"headline":"Dokan \u003c 3.7.6 - Unauthenticated SQLi","id":"CVE-2022-3915"},"packages":[],"prev":{"headline":"User Registration \u003c 2.2.4.1 - Subscriber+ Arbitrary File Upload","id":"CVE-2022-3912"},"products":["InsightVM","Nexpose"],"published":"2023-02-01","related":[{"cvss_score":8.8,"headline":"Cross-site request forgery in Nexpose","id":"CVE-2017-5264","kev_date_added":null,"published":"2017-12-14"},{"cvss_score":8.7,"headline":"Rapid7 Nexpose Insufficient Session Management","id":"CVE-2019-5638","kev_date_added":null,"published":"2019-08-21"},{"cvss_score":8.5,"headline":"Weak cryptography in Nexpose hardware appliance","id":"CVE-2017-5243","kev_date_added":null,"published":"2017-06-06"},{"cvss_score":7.8,"headline":"Other in Nexpose","id":"CVE-2017-5232","kev_date_added":null,"published":"2017-03-02"},{"cvss_score":7.2,"headline":"Hardcoded credentials in Nexpose","id":"CVE-2017-5230","kev_date_added":null,"published":"2017-03-02"},{"cvss_score":6.8,"headline":"Unquoted Path in Rapid7 Nexpose Installer","id":"CVE-2020-7382","kev_date_added":null,"published":"2020-09-03"},{"cvss_score":6.8,"headline":"Cross-site request forgery in n/a","id":"CVE-2012-6493","kev_date_added":null,"published":"2014-02-04"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2025-03-26","vendors":["Rapid7"]},"summary":"Attacker with network access can bypass TLS certificate validation during updates, potentially intercepting traffic, though code signing prevents malicious package execution.","url":"https://insights.sbomify.com/CVE-2022-3913/"}