Lucene search

Rapid7CVELIST:CVE-2019-5641

HistoryAug 30, 2022 - 12:00 a.m.

CVE-2019-5641 Rapid7 InsightVM Information Disclosure after Logout

2022-08-3000:00:00

CWE-200

rapid7

www.cve.org

rapid7

insightvm

information exposure

3.3 Low

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

5.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

31.3%

JSON

Rapid7 InsightVM suffers from an information exposure issue whereby, when the user’s session has ended due to inactivity, an attacker can use the Inspect Element browser feature to remove the login panel and view the details available in the last webpage visited by previous user

CNA Affected

[
  {
    "product": "InsightVM",
    "vendor": "Rapid7",
    "versions": [
      {
        "lessThanOrEqual": "6.6.160",
        "status": "affected",
        "version": "6.6.160",
        "versionType": "custom"
      }
    ]
  }
]

References

docs.rapid7.com/release-notes/insightvm/20220830/

3.3 Low

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

5.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

31.3%

JSON

Related for CVELIST:CVE-2019-5641