{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2013-01-02T00:00:00", "descriptions": [{"lang": "en", "value": "Cross-site request forgery (CSRF) vulnerability in Rapid7 Nexpose Security Console before 5.5.4 allows remote attackers to hijack the authentication of unspecified victims for requests that delete scan data and sites via a request to data/site/delete."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2014-02-04T16:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "23924", "tags": ["exploit", "x_refsource_EXPLOIT-DB"], "url": "http://www.exploit-db.com/exploits/23924"}, {"name": "88923", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/88923"}, {"name": "20130103 CVE-2012-6493 - Nexpose Security Console - Cross-Site Request Forgery (CSRF)", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://archives.neohapsis.com/archives/bugtraq/2013-01/0014.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://community.rapid7.com/docs/DOC-2155#release1"}, {"tags": ["x_refsource_MISC"], "url": "http://packetstormsecurity.com/files/119260/Nexpose-Security-Console-Cross-Site-Request-Forgery.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2012-6493", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Cross-site request forgery (CSRF) vulnerability in Rapid7 Nexpose Security Console before 5.5.4 allows remote attackers to hijack the authentication of unspecified victims for requests that delete scan data and sites via a request to data/site/delete."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "23924", "refsource": "EXPLOIT-DB", "url": "http://www.exploit-db.com/exploits/23924"}, {"name": "88923", "refsource": "OSVDB", "url": "http://osvdb.org/88923"}, {"name": "20130103 CVE-2012-6493 - Nexpose Security Console - Cross-Site Request Forgery (CSRF)", "refsource": "BUGTRAQ", "url": "http://archives.neohapsis.com/archives/bugtraq/2013-01/0014.html"}, {"name": "https://community.rapid7.com/docs/DOC-2155#release1", "refsource": "CONFIRM", "url": "https://community.rapid7.com/docs/DOC-2155#release1"}, {"name": "http://packetstormsecurity.com/files/119260/Nexpose-Security-Console-Cross-Site-Request-Forgery.html", "refsource": "MISC", "url": "http://packetstormsecurity.com/files/119260/Nexpose-Security-Console-Cross-Site-Request-Forgery.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T21:28:39.814Z"}, "title": "CVE Program Container", "references": [{"name": "23924", "tags": ["exploit", "x_refsource_EXPLOIT-DB", "x_transferred"], "url": "http://www.exploit-db.com/exploits/23924"}, {"name": "88923", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/88923"}, {"name": "20130103 CVE-2012-6493 - Nexpose Security Console - Cross-Site Request Forgery (CSRF)", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://archives.neohapsis.com/archives/bugtraq/2013-01/0014.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://community.rapid7.com/docs/DOC-2155#release1"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://packetstormsecurity.com/files/119260/Nexpose-Security-Console-Cross-Site-Request-Forgery.html"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2012-6493", "datePublished": "2014-02-04T17:00:00", "dateReserved": "2013-01-02T00:00:00", "dateUpdated": "2024-08-06T21:28:39.814Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:rapid7:nexpose:*:*:*:*:*:*:*:*", "matchCriteriaId": "A7092419-CD5C-4D96-B3F0-18724CE62216", "versionEndIncluding": "5.5.3", "vulnerable": true}, {"criteria": "cpe:2.3:a:rapid7:nexpose:5.4:*:*:*:*:*:*:*", "matchCriteriaId": "6E99F219-046F-4272-9390-FEDD119D4480", "vulnerable": true}, {"criteria": "cpe:2.3:a:rapid7:nexpose:5.4.1:*:*:*:*:*:*:*", "matchCriteriaId": "2D00215B-C6FB-44E8-8FBB-56A13AC70009", "vulnerable": true}, {"criteria": "cpe:2.3:a:rapid7:nexpose:5.4.2:*:*:*:*:*:*:*", "matchCriteriaId": "129A50F9-509C-42D5-A185-8AA88D468CA8", "vulnerable": true}, {"criteria": "cpe:2.3:a:rapid7:nexpose:5.4.3:*:*:*:*:*:*:*", "matchCriteriaId": "CE07CAC2-F931-4CFE-9883-A2C48FE73958", "vulnerable": true}, {"criteria": "cpe:2.3:a:rapid7:nexpose:5.4.4:*:*:*:*:*:*:*", "matchCriteriaId": "E174D181-143F-4F63-9A5C-7A477CA5AD00", "vulnerable": true}, {"criteria": "cpe:2.3:a:rapid7:nexpose:5.4.5:*:*:*:*:*:*:*", "matchCriteriaId": "31CD346D-D2F6-4EB1-B1B8-3A435678D5D1", "vulnerable": true}, {"criteria": "cpe:2.3:a:rapid7:nexpose:5.4.6:*:*:*:*:*:*:*", "matchCriteriaId": "A36059AE-A763-4C01-863C-348FC77CE582", "vulnerable": true}, {"criteria": "cpe:2.3:a:rapid7:nexpose:5.4.7:*:*:*:*:*:*:*", "matchCriteriaId": "28F06A18-7C2C-4789-82AE-96C3A741962F", "vulnerable": true}, {"criteria": "cpe:2.3:a:rapid7:nexpose:5.4.8:*:*:*:*:*:*:*", "matchCriteriaId": "F0DA6563-3C35-4739-A443-14F7DE3B76A2", "vulnerable": true}, {"criteria": "cpe:2.3:a:rapid7:nexpose:5.4.9:*:*:*:*:*:*:*", "matchCriteriaId": "2C91691B-FDC9-4B98-AACC-17723FCDD3C7", "vulnerable": true}, {"criteria": "cpe:2.3:a:rapid7:nexpose:5.4.10:*:*:*:*:*:*:*", "matchCriteriaId": "7DDF8104-9494-4995-8F4F-8B5140868A81", "vulnerable": true}, {"criteria": "cpe:2.3:a:rapid7:nexpose:5.4.11:*:*:*:*:*:*:*", "matchCriteriaId": "844792DE-6A21-41B0-97AD-72CFB1821386", "vulnerable": true}, {"criteria": "cpe:2.3:a:rapid7:nexpose:5.4.12:*:*:*:*:*:*:*", "matchCriteriaId": "256309DB-D90C-4C37-B241-665F25FB47B8", "vulnerable": true}, {"criteria": "cpe:2.3:a:rapid7:nexpose:5.5.1:*:*:*:*:*:*:*", "matchCriteriaId": "733076EC-78D0-4C5D-AA11-6CAABF980755", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cross-site request forgery (CSRF) vulnerability in Rapid7 Nexpose Security Console before 5.5.4 allows remote attackers to hijack the authentication of unspecified victims for requests that delete scan data and sites via a request to data/site/delete."}, {"lang": "es", "value": "Vulnerabilidad de CSRF en Rapid7 Nexpose Security Console anterior a 5.5.4 permite a atacantes remotos secuestrar la autenticaci\u00f3n de victimas no especificadas para solicitudes que eliminan datos de an\u00e1lisis y sitios a trav\u00e9s de una solicitud hacia data/site/delete."}], "id": "CVE-2012-6493", "lastModified": "2025-04-11T00:51:21.963", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2014-02-04T22:55:03.270", "references": [{"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://archives.neohapsis.com/archives/bugtraq/2013-01/0014.html"}, {"source": "cve@mitre.org", "url": "http://osvdb.org/88923"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://packetstormsecurity.com/files/119260/Nexpose-Security-Console-Cross-Site-Request-Forgery.html"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://www.exploit-db.com/exploits/23924"}, {"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "https://community.rapid7.com/docs/DOC-2155#release1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://archives.neohapsis.com/archives/bugtraq/2013-01/0014.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/88923"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://packetstormsecurity.com/files/119260/Nexpose-Security-Console-Cross-Site-Request-Forgery.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://www.exploit-db.com/exploits/23924"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://community.rapid7.com/docs/DOC-2155#release1"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}