Lucene search

[email protected]CVE-2024-2745

HistoryApr 02, 2024 - 10:15 a.m.

CVE-2024-2745

2024-04-0210:15:09

CWE-598

[email protected]

web.nvd.nist.gov

rapid7

insightvm

maintenance mode

sensitive information exposure

vulnerability

query strings

url

attackers

passwords

auth tokens

usernames

remediated

version 6.6.244

3.3 Low

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

6.3 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.0%

JSON

Rapid7’s InsightVM maintenance mode login page suffers from a sensitive information exposure vulnerability whereby, sensitive information is exposed through query strings in the URL when login is attempted before the page is fully loaded. This vulnerability allows attackers to acquire sensitive information such as passwords, auth tokens, usernames etc.

The vulnerability is remediated in version 6.6.244.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "InsightVM",
    "vendor": "Rapid7",
    "versions": [
      {
        "lessThan": "6.6.244",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

docs.rapid7.com/release-notes/insightvm/20240327/

3.3 Low

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

6.3 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.0%

JSON

Related for CVE-2024-2745

cvelist1 nvd1