CVE-2017-5264 - AskarLabs CVE Database

CVE-2017-5264

Vendor Rapid7

Product Nexpose

Weakness CWE-352 · CSRF

Published December 14, 2017

Last update August 5, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Versions of Nexpose prior to 6.4.66 fail to adequately validate the source of HTTP requests intended for the Automated Actions administrative web application, and are susceptible to a cross-site request forgery (CSRF) attack.

Key dates

02Disclosure timeline

December 14, 2017 CVE published

August 5, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2017-5264 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/352.html

Related vulnerabilities

04Related CVE

CVE-2025-14734 Amazon affiliate lite Plugin <= 1.0.0 - Cross-Site Request Forgery to Plugin Settings Update CVE-2024-1642 MainWP Dashboard <= 4.6.0.1 - Cross-Site Request Forgery via posting_bulk CVE-2024-55922 Cross-Site Request Forgery in Form Framework Module in TYPO3 CVE-2022-47165 WordPress CoSchedule Plugin <= 3.3.8 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2024-51643 WordPress Amazon Associate Filter plugin <= 0.4 - CSRF to Stored XSS vulnerability