« Volver al listado

CVE-2017-5230

Estado: ModificadaAlta (7.2)—

The Java keystore in all versions and editions of Rapid7 Nexpose prior to 6.4.50 is encrypted with a static password of 'r@p1d7k3y5t0r3' which is not modifiable by the user. The keystore provides storage for saved scan credentials in an otherwise secure location on disk.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Rapid7 — Nexpose

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-5230",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 7.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "cve@rapid7.com",
      "affectedData": [
        {
          "vendor": "Rapid7",
          "product": "Nexpose",
          "versions": [
            {
              "status": "affected",
              "version": "6.4.49 and prior"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-03-02T20:59:00.547",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/96956",
      "source": "cve@rapid7.com"
    },
    {
      "url": "https://community.rapid7.com/community/infosec/blog/2017/03/01/multiple-vulnerabilities-affecting-four-rapid7-products",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "cve@rapid7.com"
    },
    {
      "url": "https://help.rapid7.com/nexpose/en-us/release-notes/#6.4.50",
      "source": "cve@rapid7.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/96956",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://community.rapid7.com/community/infosec/blog/2017/03/01/multiple-vulnerabilities-affecting-four-rapid7-products",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://help.rapid7.com/nexpose/en-us/release-notes/#6.4.50",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-798"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Java keystore in all versions and editions of Rapid7 Nexpose prior to 6.4.50 is encrypted with a static password of 'r@p1d7k3y5t0r3' which is not modifiable by the user. The keystore provides storage for saved scan credentials in an otherwise secure location on disk."
    },
    {
      "lang": "es",
      "value": "El almacén de claves de Java en todas las versiones y ediciones de Nexpose anterior a versión 6.4.50 de Rapid7, es cifrado con una contraseña estática de “r@p1d7k3y5t0r3” que no es modificable por el usuario. El almacén de claves provee almacenamiento para las credenciales de análisis guardadas en una lugar de otro modo seguro en el disco."
    }
  ],
  "lastModified": "2026-06-17T01:20:12.483",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:rapid7:nexpose:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F0982147-6D64-497D-938C-754B9BEEDC2C",
              "versionEndIncluding": "6.4.23"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@rapid7.com"
}