CVE-2023-5950
Rapid7 Velociraptor Reflected XSS
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Rapid7 Velociraptor Reflected XSS
| Assigner | rapid7 |
| Reserved | 2023-11-03 |
| Published | 2023-11-06 |
| Updated | 2024-09-05 |
Rapid7 Velociraptor versions prior to 0.7.0-4 suffer from a reflected cross site scripting vulnerability. This vulnerability allows attackers to inject JS into the error path, potentially leading to unauthorized execution of scripts within a user's web browser. This vulnerability is fixed in version 0.7.0-04 and a patch is available to download. Patches are also available for version 0.6.9 (0.6.9-1).
| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L |
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Mathias Kujala
https://github.com/Velocidex/velociraptor/releases/tag/v0.7.0
