cve/2017/CVE-2017-5230.md

### [CVE-2017-5230](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5230)
![](https://img.shields.io/static/v1?label=Product&message=Nexpose&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=Hard-Coded%20Password&color=brighgreen)

### Description

The Java keystore in all versions and editions of Rapid7 Nexpose prior to 6.4.50 is encrypted with a static password of 'r@p1d7k3y5t0r3' which is not modifiable by the user. The keystore provides storage for saved scan credentials in an otherwise secure location on disk.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/ARPSyndicate/cvemon
- https://github.com/Lingom-KSR/Clair-CLI
- https://github.com/arminc/clair-scanner
- https://github.com/jgsqware/clairctl
- https://github.com/joelee2012/claircli
- https://github.com/mightysai1997/clair-scanner
- https://github.com/pruthv1k/clair-scan
- https://github.com/pruthvik9/clair-scan