Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2016-9757

In the Create Tags page of the Rapid7 Nexpose version 6.4.12 user interface, any authenticated user who has the capability to create tags can inject cross-site scripting (XSS) elem

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
rapid7

Description

In the Create Tags page of the Rapid7 Nexpose version 6.4.12 user interface, any authenticated user who has the capability to create tags can inject cross-site scripting (XSS) elements in the tag name field. Once this tag is viewed in the Tag Detail page of the Rapid7 Nexpose 6.4.12 UI by another authenticated user, the script is run in that user's browser context.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Rapid7 Nexpose

  • 6.4.12affected

References