CVE-2023-5950
High
Description
Rapid7 Velociraptor versions prior to 0.7.0-4 suffer from a reflected cross site scripting vulnerability. This vulnerability allows attackers to inject JS into the error path, potentially leading to unauthorized execution of scripts within a user's web browser. This vulnerability is fixed in version 0.7.0-04 and a patch is available to download. Patches are also available for version 0.6.9 (0.6.9-1).
SeverityHigh
CVSS8.6
Exploit probability—
ProductRapid7 Velociraptor
PublishedNov 6, 2023
First seenNov 6, 2023
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- rapid7 velociraptor0.6.9-1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rapid7 velociraptor | v < 0.6.9-1, 0.7.0, 0.7.0-3 | 0.6.9-1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.