CVE-2024-2745lowCWE-598

CVE-2024-2745: low-severity vulnerability in Rapid7 InsightVM

Rapid7 InsightVM Sensitive Information Exposure via URL

Published · Updated

Follow this CVE+ Monitor InsightVM

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 3.3epss 0.2%
Rapid7's InsightVM maintenance mode login page suffers from a sensitive information exposure vulnerability whereby, sensitive information is exposed through query strings in the URL when login is attempted before the page is fully loaded.  This vulnerability allows attackers to acquire sensitive information such as passwords, auth tokens, usernames etc.     The vulnerability is remediated in version 6.6.244. 
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected products
Rapid7 · InsightVM
Related CVEs — Rapid7 InsightVM

In the same product, most dangerous first.

CVE-2019-5615LOWRapid7 InsightVM Stored Credential ExposureEPSS 0.8%CVE-2019-5641LOWRapid7 InsightVM Information Disclosure after LogoutEPSS 0.4%CVE-2021-3844MEDIUMRapid7 InsightVM Insufficient Session ExpirationEPSS 0.4%CVE-2022-4261MEDIUMRapid7 Nexpose Update Validation IssueEPSS 0.3%CVE-2024-6504MEDIUMRapid7 InsightVM Protection Mechanism FailureEPSS 0.3%CVE-2022-3913MEDIUMRapid7 Nexpose Certificate Validation IssueEPSS 0.3%