PT-2017-16405
CVE-2017-5230
·
Published
2017-03-02
·
Updated
2017-08-15
Description by
CVSS 3.1
7.2
HighMetricsAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Rapid7 Nexpose versions prior to 6.4.50
Description
The Java keystore in Rapid7 Nexpose uses a static, unmodifiable password for encryption, which may compromise the security of saved scan credentials stored in the keystore.
Recommendations
For versions prior to 6.4.50, update to version 6.4.50 or later to address the issue with the static password used for the Java keystore encryption.
Found an issue in the description? Have something to add? Feel free to write us 👾