CVE-2012-6493

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2014-02-04 · updated 2026-06-16
Weakness: CWE-352

Description

Cross-site request forgery (CSRF) vulnerability in Rapid7 Nexpose Security Console before 5.5.4 allows remote attackers to hijack the authentication of unspecified victims for requests that delete scan data and sites via a request to data/site/delete.

Affected products

Rapid7 Nexpose: through 5.5.3; 5.4, 5.4.1, 5.4.2, 5.4.3, 5.4.4, 5.4.5 (+8)

References

http://archives.neohapsis.com/archives/bugtraq/2013-01/0014.html
http://osvdb.org/88923
http://packetstormsecurity.com/files/119260/Nexpose-Security-Console-Cross-Site-Request-Forgery.html
http://www.exploit-db.com/exploits/23924
https://community.rapid7.com/docs/DOC-2155#release1
http://archives.neohapsis.com/archives/bugtraq/2013-01/0014.html
http://osvdb.org/88923
http://packetstormsecurity.com/files/119260/Nexpose-Security-Console-Cross-Site-Request-Forgery.html
http://www.exploit-db.com/exploits/23924
https://community.rapid7.com/docs/DOC-2155#release1

Get alerted when CVE-2012-6493 or the next vulnerability affects your stack