CVE-2022-4261

Rapid7 Nexpose and InsightVM versions prior to 6.6.172 failed to reliably validate the authenticity of update contents. This failure could allow an attacker to provide a malicious update and alter the functionality of Rapid7 Nexpose. The attacker would need some pre-existing mechanism to provide a malicious update, either through a social engineering effort, privileged access to replace downloaded updates in transit, or by performing an Attacker-in-the-Middle attack on the update service itself.

• CWE-494
• CWE-494

• https://docs.rapid7.com/release-notes/insightvm/20221207/Release Notes, Vendor Advisory
• https://docs.rapid7.com/release-notes/nexpose/20221207/Release Notes, Vendor Advisory
• https://www.rapid7.com/blog/post/2022/12/7/cve-2022-4261-rapid7-nexpose-update-validation-issue-fixedExploit, Mitigation, Vendor Advisory
• https://docs.rapid7.com/release-notes/insightvm/20221207/Release Notes, Vendor Advisory
• https://docs.rapid7.com/release-notes/nexpose/20221207/Release Notes, Vendor Advisory
• https://www.rapid7.com/blog/post/2022/12/7/cve-2022-4261-rapid7-nexpose-update-validation-issue-fixedExploit, Mitigation, Vendor Advisory

Published

Dec 8, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-4255An info leak issue was identified in all versions of GitLab …5.3
• CVE-2022-4256The All-in-One Addons for Elementor WordPress plugin before …4.8
• CVE-2022-4257A vulnerability was found in C-DATA Web Management System. I…9.8
• CVE-2022-4258In multiple versions of HIMA PC based Software an unquoted W…7.8
• CVE-2022-4259Due to improper input validation in the Alerts controller, a…8.8
• CVE-2022-4260The WP-Ban WordPress plugin before 1.69.1 does not sanitise …4.8
• CVE-2022-4262Type confusion in V8 in Google Chrome prior to 108.0.5359.94…8.8
• CVE-2022-4264Incorrect Privilege Assignment in M-Files Web (Classic) in M…4.3
• CVE-2022-4265The Replyable WordPress plugin before 2.2.10 does not valida…8.8
• CVE-2022-4266The Bulk Delete Users by Email WordPress plugin through 1.2 …6.5
• CVE-2022-4267The Bulk Delete Users by Email WordPress plugin through 1.2 …6.1
• CVE-2022-4268The Plugin Logic WordPress plugin before 1.0.8 does not sani…7.2