Description (CNA)
Rapid7 Nexpose versions 6.4.50 and later are vulnerable to an insufficient entropy issue in the CredentialsKeyStorePassword.generateRandomPassword() method. When updating legacy keystore passwords, the application generates a new password with insufficient length (7-12 characters) and a static prefix 'p', resulting in a weak keyspace. An attacker with access to the nsc.ks file can brute-force this password using consumer-grade hardware to decrypt stored credentials.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Rapid7 / InsightVM/Nexpose | affected 6.4.50 before 8.36.0 |
CWE
CWE-331
References
ADP enrichment
No English description supplied.
No references supplied.