CVE-2022-4261 Rapid7 Nexpose Update Validation Issue
Attackers can execute malicious code by providing unvalidated updates to Rapid7 Nexpose or InsightVM, requiring MITM or privileged access.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-4261?
CVE-2022-4261 is a medium-severity vulnerability in Rapid7 InsightVM, published on 7 Dec 2022. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Rapid7 Nexpose and InsightVM versions prior to 6.6.172 failed to reliably validate the authenticity of update contents. This failure could allow an attacker to provide a malicious update and alter the functionality of Rapid7 Nexpose. The attacker would need some pre-existing mechanism to provide a malicious update, either through a social engineering effort, privileged access to replace downloaded updates in transit, or by performing an Attacker-in-the-Middle attack on the update service itself.
Weakness: CWE-494
Which versions are affected by CVE-2022-4261?
It affects 2 products.
Products include Rapid7 Insightvm, Rapid7 Nexpose.
How do I fix CVE-2022-4261?
No fix has been published for CVE-2022-4261 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-4261 being exploited?
There is no known exploitation of CVE-2022-4261 in the wild and no public exploit code.
Other vulnerabilities in Rapid7 InsightVM
- CVE-2017-5242 Rapid7 Nexpose Virtual Appliance Duplicate SSH Host Key
- CVE-2021-3844 Rapid7 InsightVM Insufficient Session Expiration
- CVE-2024-6504 Rapid7 InsightVM Protection Mechanism Failure
- CVE-2023-0681 Rapid7 Nexpose Uncontrolled URL Redirect
- CVE-2024-2745 Rapid7 InsightVM Sensitive Information Exposure via URL
Sources
Also known as GHSA-hvmw-5h37-j7f5.