CVE-2019-5630 Vulnerability Details

  /     /     /  

CVE-2019-5630 Metadata Quick Info

CVE Published: 03/07/2019 | CVE Updated: 04/08/2024 | CVE Year: 2019
Source: rapid7 | Vendor: Rapid7 | Product: Nexpose/InsightVM Security Console
Status : PUBLISHED

---

CVE-2019-5630 Description

A Cross-Site Request Forgery (CSRF) vulnerability was found in Rapid7 Nexpose InsightVM Security Console versions 6.5.0 through 6.5.68. This issue allows attackers to exploit CSRF vulnerabilities on API endpoints using Flash to circumvent a cross-domain pre-flight OPTIONS request.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID:
CWE Name: Cross-Site Request Forgery
Source: Rapid7

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).