CVE-2022-4261

CVE-2022-4261 is a medium-severity vulnerability in Rapid7 Insightvm with a CVSS 3.x base score of 4.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-494.

Key facts

Description

Rapid7 Nexpose and InsightVM versions prior to 6.6.172 failed to reliably validate the authenticity of update contents. This failure could allow an attacker to provide a malicious update and alter the functionality of Rapid7 Nexpose. The attacker would need some pre-existing mechanism to provide a malicious update, either through a social engineering effort, privileged access to replace downloaded updates in transit, or by performing an Attacker-in-the-Middle attack on the update service itself.

Frequently asked questions

What is CVE-2022-4261?
Rapid7 Nexpose and InsightVM versions prior to 6.6.172 failed to reliably validate the authenticity of update contents. This failure could allow an attacker to provide a malicious update and alter the functionality of Rapid7 Nexpose. The attacker would need some pre-existing mechanism to provide a malicious update, either through a social engineering effort, privileged access to replace downloaded updates in transit, or by performing an Attacker-in-the-Middle attack on the update service itself.
How severe is CVE-2022-4261?
CVE-2022-4261 has a CVSS 3.x base score of 4.4, rated medium severity. It is exploitable over local access with high attack complexity, requires low privileges and user interaction. Impact on confidentiality is none, integrity high, and availability none.
Is CVE-2022-4261 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (23rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2022-4261?
CVE-2022-4261 primarily affects Rapid7 Insightvm. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2022-4261?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2022-4261 published?
CVE-2022-4261 was published on 2022-12-08 and last updated on 2026-06-17.

References

Affected products (2)

More vulnerabilities in Rapid7 Insightvm

All CVEs affecting Rapid7 Insightvm →

Other CWE-494 vulnerabilities

Browse all CWE-494 vulnerabilities →