CVE-2023-5950: Rapid7 Velociraptor versions prior to 0.7.0-4 suffer from a reflected cross site scripting vulnerability. This vulnerability allows attackers to inject JS into…

PriorityP426medium6.1CVSS 3.1

AVNACLPRNUIRSCCLILAN

EPSS

0.46%

36.9th percentile

Rapid7 Velociraptor versions prior to 0.7.0-4 suffer from a reflected cross site scripting vulnerability. This vulnerability allows attackers to inject JS into the error path, potentially leading to unauthorized execution of scripts within a user's web browser. This vulnerability is fixed in version 0.7.0-04 and a patch is available to download. Patches are also available for version 0.6.9 (0.6.9-1).

Affected

4 ranges

Vendor	Product	Version range	Fixed in
rapid7	velociraptor	< 0.7.0-4	0.7.0-4
rapid7	velociraptor	< 0.6.9-1	0.6.9-1
rapid7	velociraptor	—	—
rapid7	velociraptor	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.