CVE-2019-5615: low-severity vulnerability in Rapid7 InsightVM
Rapid7 InsightVM Stored Credential Exposure
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
8Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 3.1epss 0.8%
Users with Site-level permissions can access files containing the username-encrypted passwords of Security Console Global Administrators and clear-text passwords for restoring backups, as well as the salt for those passwords. Valid credentials are required to access these files and malicious users would still need to perform additional work to decrypt the credentials and escalate privileges. This issue affects: Rapid7 InsightVM versions 6.5.11 through 6.5.49.
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected products
Rapid7 · InsightVMRelated CVEs — Rapid7 InsightVM
In the same product, most dangerous first.
CVE-2019-5641LOWRapid7 InsightVM Information Disclosure after LogoutEPSS 0.4%CVE-2021-3844MEDIUMRapid7 InsightVM Insufficient Session ExpirationEPSS 0.4%CVE-2022-4261MEDIUMRapid7 Nexpose Update Validation IssueEPSS 0.3%CVE-2024-6504MEDIUMRapid7 InsightVM Protection Mechanism FailureEPSS 0.3%CVE-2022-3913MEDIUMRapid7 Nexpose Certificate Validation IssueEPSS 0.3%CVE-2024-2745LOWRapid7 InsightVM Sensitive Information Exposure via URLEPSS 0.2%