Strix
26.1K

CVE-2022-4261

MEDIUMCVSS 6.5/10EPSS 0.31%

Last modified

CVE-2022-4261 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. Rapid7 Nexpose and InsightVM versions prior to 6.6.172 failed to reliably validate the authenticity of update contents. This failure could allow an attacker to provide a malicious update and alter the functionality of Rapid7 Nexpose. EPSS estimates a 0.31% chance of exploitation in the next 30 days.

Description

Rapid7 Nexpose and InsightVM versions prior to 6.6.172 failed to reliably validate the authenticity of update contents. This failure could allow an attacker to provide a malicious update and alter the functionality of Rapid7 Nexpose. The attacker would need some pre-existing mechanism to provide a malicious update, either through a social engineering effort, privileged access to replace downloaded updates in transit, or by performing an Attacker-in-the-Middle attack on the update service itself.

Metrics

CVSS 3.1
6.5/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS Probability
0.31%

22.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
Rapid7Insightvm< 6.6.172
Rapid7Nexpose< 6.6.172

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2022-4261?
Rapid7 Nexpose and InsightVM versions prior to 6.6.172 failed to reliably validate the authenticity of update contents. This failure could allow an attacker to provide a malicious update and alter the functionality of Rapid7 Nexpose. The attacker would need some pre-existing mechanism to provide a malicious update, either through a social engineering effort, privileged access to replace downloaded updates in transit, or by performing an Attacker-in-the-Middle attack on the update service itself.
How severe is CVE-2022-4261?
CVE-2022-4261 has a CVSS score of 6.5/10 (MEDIUM severity). The EPSS model estimates a 0.31% probability of exploitation in the next 30 days.
How do I fix CVE-2022-4261?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2022-4261?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST