Read the docs
TI-2012-05211 Aliases CVE-2012-6493GHSA-2q79-mpxf-8x5p

Cross-site request forgery (CSRF) vulnerability in Rapid7 Nexpose Security Console before…

Priority LOW 34CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Tampering
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-352.

Summary

Cross-site request forgery (CSRF) vulnerability in Rapid7 Nexpose Security Console before 5.5.4 allows remote attackers to hijack the authentication of unspecified victims for requests that delete scan data and sites via a request to data/site/delete.

Why it matters now

EPSS 0.02306 83rd percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by the CNA and NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 15

CPEVersionsRoleVendor
cpe:2.3:a:rapid7:nexpose:*:*:*:*:*:*:*:*up to 5.5.3VulnerableRapid7
cpe:2.3:a:rapid7:nexpose:5.4:*:*:*:*:*:*:*5.4VulnerableRapid7
cpe:2.3:a:rapid7:nexpose:5.4.1:*:*:*:*:*:*:*5.4.1VulnerableRapid7
cpe:2.3:a:rapid7:nexpose:5.4.2:*:*:*:*:*:*:*5.4.2VulnerableRapid7
cpe:2.3:a:rapid7:nexpose:5.4.3:*:*:*:*:*:*:*5.4.3VulnerableRapid7
cpe:2.3:a:rapid7:nexpose:5.4.4:*:*:*:*:*:*:*5.4.4VulnerableRapid7
cpe:2.3:a:rapid7:nexpose:5.4.5:*:*:*:*:*:*:*5.4.5VulnerableRapid7
cpe:2.3:a:rapid7:nexpose:5.4.6:*:*:*:*:*:*:*5.4.6VulnerableRapid7
cpe:2.3:a:rapid7:nexpose:5.4.7:*:*:*:*:*:*:*5.4.7VulnerableRapid7
cpe:2.3:a:rapid7:nexpose:5.4.8:*:*:*:*:*:*:*5.4.8VulnerableRapid7
  • cpe:2.3:a:rapid7:nexpose:*:*:*:*:*:*:*:* Versions up to 5.5.3 Vulnerable ·Rapid7
  • cpe:2.3:a:rapid7:nexpose:5.4:*:*:*:*:*:*:* Versions 5.4 Vulnerable ·Rapid7
  • cpe:2.3:a:rapid7:nexpose:5.4.1:*:*:*:*:*:*:* Versions 5.4.1 Vulnerable ·Rapid7
  • cpe:2.3:a:rapid7:nexpose:5.4.2:*:*:*:*:*:*:* Versions 5.4.2 Vulnerable ·Rapid7
  • cpe:2.3:a:rapid7:nexpose:5.4.3:*:*:*:*:*:*:* Versions 5.4.3 Vulnerable ·Rapid7
  • cpe:2.3:a:rapid7:nexpose:5.4.4:*:*:*:*:*:*:* Versions 5.4.4 Vulnerable ·Rapid7
  • cpe:2.3:a:rapid7:nexpose:5.4.5:*:*:*:*:*:*:* Versions 5.4.5 Vulnerable ·Rapid7
  • cpe:2.3:a:rapid7:nexpose:5.4.6:*:*:*:*:*:*:* Versions 5.4.6 Vulnerable ·Rapid7
  • cpe:2.3:a:rapid7:nexpose:5.4.7:*:*:*:*:*:*:* Versions 5.4.7 Vulnerable ·Rapid7
  • cpe:2.3:a:rapid7:nexpose:5.4.8:*:*:*:*:*:*:* Versions 5.4.8 Vulnerable ·Rapid7
Show 5 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:rapid7:nexpose:5.4.9:*:*:*:*:*:*:*5.4.9VulnerableRapid7
cpe:2.3:a:rapid7:nexpose:5.4.10:*:*:*:*:*:*:*5.4.10VulnerableRapid7
cpe:2.3:a:rapid7:nexpose:5.4.11:*:*:*:*:*:*:*5.4.11VulnerableRapid7
cpe:2.3:a:rapid7:nexpose:5.4.12:*:*:*:*:*:*:*5.4.12VulnerableRapid7
cpe:2.3:a:rapid7:nexpose:5.5.1:*:*:*:*:*:*:*5.5.1VulnerableRapid7
  • cpe:2.3:a:rapid7:nexpose:5.4.9:*:*:*:*:*:*:* Versions 5.4.9 Vulnerable ·Rapid7
  • cpe:2.3:a:rapid7:nexpose:5.4.10:*:*:*:*:*:*:* Versions 5.4.10 Vulnerable ·Rapid7
  • cpe:2.3:a:rapid7:nexpose:5.4.11:*:*:*:*:*:*:* Versions 5.4.11 Vulnerable ·Rapid7
  • cpe:2.3:a:rapid7:nexpose:5.4.12:*:*:*:*:*:*:* Versions 5.4.12 Vulnerable ·Rapid7
  • cpe:2.3:a:rapid7:nexpose:5.5.1:*:*:*:*:*:*:* Versions 5.5.1 Vulnerable ·Rapid7

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2012-6493
  2. 2026-10-03 Alias added: GHSA-2q79-mpxf-8x5p

References

Exploit 3

Patch 1

Other 1

  • TI-2017-03371 Cross-site request forgery in Rapid7 Nexpose CVSS 3.0HIGH 8.8
  • TI-2023-01595 Rapid7 Nexpose Forced Browsing CVSS 3.1CRITICAL 9.8
  • TI-2022-00668 Rapid7 Nexpose SQL Injection CVSS 3.1HIGH 8.8
  • TI-2019-03994 Rapid7 Nexpose/InsightVM Security Console CSRF CVSS 3.0HIGH 8.8
  • TI-2019-04002 Rapid7 Nexpose Insufficient Session Management CVSS 3.1HIGH 8.7
  • TI-2020-05966 SQL Injection in Rapid7 Nexpose CVSS 3.1HIGH 8.1
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences