CVE-2023-0681: Rapid7 Nexpose Uncontrolled URL Redirect

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-03-20 · updated 2026-06-17
Weakness: CWE-601

Description

Rapid7 InsightVM versions 6.6.178 and lower suffers from an open redirect vulnerability, whereby an attacker has the ability to redirect the user to a site of the attacker’s choice using the ‘page’ parameter of the ‘data/console/redirect’ component of the application. This issue was resolved in the February, 2023 release of version 6.6.179.

Affected products

Rapid7 InsightVM: before 6.6.179 — fixed in 6.6.179

How to fix

Upgrade to a fixed version: Rapid7 InsightVM 6.6.179. Check the vendor advisory for mitigations.

References

https://docs.rapid7.com/release-notes/nexpose/20230208/
https://docs.rapid7.com/release-notes/nexpose/20230208/

Get alerted when CVE-2023-0681 or the next vulnerability affects your stack