CVE-2017-5264

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

2.75%

Published

Dec 14, 2017

Modified

May 12, 2026

Public PoC / Exploit (2)

All weaponized →

Exploit-DBNexpose < 6.4.66 - Cross-Site Request Forgery TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Versions of Nexpose prior to 6.4.66 fail to adequately validate the source of HTTP requests intended for the Automated Actions administrative web application, and are susceptible to a cross-site request forgery (CSRF) attack.

Weaknesses (CWE)

CWE-352CWE-352

Affected Products (1)

rapid7 · nexpose (up to 6.4.66)vulnerable

References (6)

http://www.securityfocus.com/bid/102208

Third Party AdvisoryVDB Entry

https://help.rapid7.com/nexpose/en-us/release-notes/archive/2017/12/#6.4.66

Release Notes

https://www.exploit-db.com/exploits/43911/

http://www.securityfocus.com/bid/102208

Third Party AdvisoryVDB Entry

https://help.rapid7.com/nexpose/en-us/release-notes/archive/2017/12/#6.4.66

Release Notes

https://www.exploit-db.com/exploits/43911/

KEV Catalog EPSS Scores Vendors All CVEs