CVE-2021-3844: medium-severity vulnerability in Rapid7 InsightVM
Rapid7 InsightVM Insufficient Session Expiration
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.7epss 0.4%
Rapid7 InsightVM suffers from insufficient session expiration when an administrator performs a security relevant edit on an existing, logged on user. For example, if a user's password is changed by an administrator due to an otherwise unrelated credential leak, that user account's current session is still valid after the password change, potentially allowing the attacker who originally compromised the credential to remain logged in and able to cause further damage. This vulnerability is mitigated by the use of the Platform Login feature. This issue is related to CVE-2019-5638.
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
Affected products
Rapid7 · InsightVMRelated CVEs — Rapid7 InsightVM
In the same product, most dangerous first.
CVE-2019-5615LOWRapid7 InsightVM Stored Credential ExposureEPSS 0.8%CVE-2019-5641LOWRapid7 InsightVM Information Disclosure after LogoutEPSS 0.4%CVE-2022-4261MEDIUMRapid7 Nexpose Update Validation IssueEPSS 0.3%CVE-2024-6504MEDIUMRapid7 InsightVM Protection Mechanism FailureEPSS 0.3%CVE-2022-3913MEDIUMRapid7 Nexpose Certificate Validation IssueEPSS 0.3%CVE-2024-2745LOWRapid7 InsightVM Sensitive Information Exposure via URLEPSS 0.2%