CVE-2023-0681

Medium

Description

Rapid7 InsightVM versions 6.6.178 and lower suffers from an open redirect vulnerability, whereby an attacker has the ability to redirect the user to a site of the attacker’s choice using the ‘page’ parameter of the ‘data/console/redirect’ component of the application. This issue was resolved in the February, 2023 release of version 6.6.179.

SeverityMedium

CVSS4.3

Exploit probability—

ProductRapid7 Insightvm

PublishedMar 20, 2023

First seenMar 20, 2023

Weakness typeCWE-601Open redirect

How to fix

Update

rapid7 insightvm6.6.179 or later

Vendor advisories

docs.rapid7.com/release-notes/nexpose/20230208/

Affected products

Product	Affected versions	Fixed in
rapid7 insightvm	v < 6.6.179	6.6.179

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.