CVE-2023-1699

9.8 criticalEPSS 0.4%

Critical (9.8) in rapid7 nexpose. EPSS 0.4% chance of exploitation in the next 30 days.

Rapid7 Nexpose versions 6.6.186 and below suffer from a forced browsing vulnerability. This vulnerability allows an attacker to manipulate URLs to forcefully browse to and access administrative pages. This vulnerability is fixed in version 6.6.187.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 38% of CVEs (scores of 2026-10-31)
CWE: CWE-425
Published: 2023-03-30
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

rapid7:nexpose

References

https://docs.rapid7.com/release-notes/nexpose/20230329/
https://docs.rapid7.com/release-notes/nexpose/20230329/

Check your stack JSON