CVE-2023-1699: Rapid7 Nexpose Forced Browsing

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-03-30 · updated 2026-06-17
Weakness: CWE-425

Description

Rapid7 Nexpose versions 6.6.186 and below suffer from a forced browsing vulnerability. This vulnerability allows an attacker to manipulate URLs to forcefully browse to and access administrative pages. This vulnerability is fixed in version 6.6.187.

Affected products

Rapid7 Nexpose: before 6.6.187 — fixed in 6.6.187

How to fix

Upgrade to a fixed version: Rapid7 Nexpose 6.6.187. Check the vendor advisory for mitigations.

References

https://docs.rapid7.com/release-notes/nexpose/20230329/
https://docs.rapid7.com/release-notes/nexpose/20230329/

Get alerted when CVE-2023-1699 or the next vulnerability affects your stack