CVE-2023-0681

MEDIUM

Rapid7 InsightVM < 6.6.179 - Open Redirect via 'page' Parameter

Title source: llm
STIX 2.1

Description

Rapid7 InsightVM versions 6.6.178 and lower suffers from an open redirect vulnerability, whereby an attacker has the ability to redirect the user to a site of the attacker’s choice using the ‘page’ parameter of the ‘data/console/redirect’ component of the application. This issue was resolved in the February, 2023 release of version 6.6.179. 

References (1)

Core 1
Core References

Scores

CVSS v3 4.3
EPSS 0.0033
EPSS Percentile 24.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-601
Status published
Products (1)
rapid7/insightvm < 6.6.179
Published Mar 20, 2023
Tracked Since Feb 18, 2026