CVE-2022-4261: Rapid7 Nexpose and InsightVM versions prior to 6.6.172 failed to reliably validate the authenticity of update contents. This failure could allow an attacker to…

PriorityP337medium6.5CVSS 3.1

AVNACLPRLUINSUCNIHAN

EPSS

0.31%

22.4th percentile

Rapid7 Nexpose and InsightVM versions prior to 6.6.172 failed to reliably validate the authenticity of update contents. This failure could allow an attacker to provide a malicious update and alter the functionality of Rapid7 Nexpose. The attacker would need some pre-existing mechanism to provide a malicious update, either through a social engineering effort, privileged access to replace downloaded updates in transit, or by performing an Attacker-in-the-Middle attack on the update service itself.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
rapid7	insightvm	< 6.6.172	6.6.172
rapid7	insightvm	<= 6.6.171	—
rapid7	nexpose	< 6.6.172	6.6.172
rapid7	nexpose	<= 6.6.171	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.