CVE-2017-5264: RAPID7 Nexpose

High severity, CVSS 8.8. EPSS: 2.7% chance of exploitation in the next 30 days.

Versions of Nexpose prior to 6.4.66 fail to adequately validate the source of HTTP requests intended for the Automated Actions administrative web application, and are susceptible to a cross-site request forgery (CSRF) attack.

Affected products

• RAPID7 Nexpose: before 6.4.66 (fixed in 6.4.66)

Published 2017-12-14. Last modified 2026-06-17.