Description (CNA)
Rapid7 Nexpose versions 6.6.93 and earlier are susceptible to an SQL Injection vulnerability, whereby valid search operators are not defined. This lack of validation can allow a logged-in, authenticated attacker to manipulate the "ANY" and "OR" operators in the SearchCriteria and inject SQL code. This issue was fixed in Rapid7 Nexpose version 6.6.129.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Rapid7 / Nexpose | affected 6.6.93 before 6.6.93 |
CWE
CWE-89
References
ADP enrichment
No English description supplied.