CVE-2022-4261: rapid7 insightvm Download of Code Without Integrity Check

Vulnerability summary

CVE-2022-4261 is a medium (CVSS 6.5) Download of Code Without Integrity Check vulnerability in rapid7 insightvm. EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 24% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 07-12-2022
   PublishedVulnerability first disclosed.
2. 14-04-2025
   Last modifiedVulnerability information updated.

Description

Rapid7 Nexpose and InsightVM versions prior to 6.6.172 failed to reliably validate the authenticity of update contents. This failure could allow an attacker to provide a malicious update and alter the functionality of Rapid7 Nexpose. The attacker would need some pre-existing mechanism to provide a malicious update, either through a social engineering effort, privileged access to replace downloaded updates in transit, or by performing an Attacker-in-the-Middle attack on the update service itself.

• CWE-494Download of Code Without Integrity CheckThe product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.