Lucene search

Rapid7CVELIST:CVE-2024-2745

HistoryApr 02, 2024 - 9:51 a.m.

CVE-2024-2745 Rapid7 InsightVM Sensitive Information Exposure via URL

2024-04-0209:51:52

CWE-598

rapid7

www.cve.org

rapid7

insightvm

sensitive information exposure

url

query strings

vulnerability

attackers

passwords

auth tokens

usernames

remediated

version 6.6.244

3.3 Low

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Rapid7’s InsightVM maintenance mode login page suffers from a sensitive information exposure vulnerability whereby, sensitive information is exposed through query strings in the URL when login is attempted before the page is fully loaded. This vulnerability allows attackers to acquire sensitive information such as passwords, auth tokens, usernames etc.

The vulnerability is remediated in version 6.6.244.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "InsightVM",
    "vendor": "Rapid7",
    "versions": [
      {
        "lessThan": "6.6.244",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

docs.rapid7.com/release-notes/insightvm/20240327/

3.3 Low

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Related for CVELIST:CVE-2024-2745