Vulnerability · Published Jun 16, 2021 · Assigned by rapid7

CVE-2021-3535

Medium 4.3

In plain English

A medium-severity cross-site scripting in Rapid7 Nexpose from Rapid7. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.6%top 52.1% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Rapid7 Nexpose is vulnerable to a non-persistent cross-site scripting vulnerability affecting the Security Console's Filtered Asset Search feature. A specific search criterion and operator combination in Filtered Asset Search could have allowed a user to pass code through the provided search field. This issue affects version 6.6.80 and prior, and is fixed in 6.6.81. If your Security Console currently falls on or within this affected version range, ensure that you update your Security Console to the latest version.

Affected products (as reported)

Vendor	Product	Versions
Rapid7	Rapid7 Nexpose	unspecified – before 6.6.81

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

References

https://docs.rapid7.com/release-notes/nexpose/20210505/ x_refsource_CONFIRM