CVE-2021-3535
Medium
Description
Rapid7 Nexpose is vulnerable to a non-persistent cross-site scripting vulnerability affecting the Security Console's Filtered Asset Search feature. A specific search criterion and operator combination in Filtered Asset Search could have allowed a user to pass code through the provided search field. This issue affects version 6.6.80 and prior, and is fixed in 6.6.81. If your Security Console currently falls on or within this affected version range, ensure that you update your Security Console to the latest version.
SeverityMedium
CVSS4.3
Exploit probability—
ProductRapid7 Nexpose
PublishedJun 16, 2021
First seenJun 16, 2021
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- rapid7 nexpose6.6.81 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rapid7 nexpose | v < 6.6.81 | 6.6.81 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.