CVE-2024-3185: medium-severity vulnerability in Rapid7 Insight Agent
Rapid7 Insight Agent Sensitive Key Exposed To Local Users
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.8epss 0.2%
A key used in logging.json does not follow the least privilege principle by default and is exposed to local users in the Rapid7 Platform. This allows an attacker with local access to a machine with the logging.json file to use that key to authenticate to the platform with high privileges. This was fixed in the Rapid7 platform starting 3 April 2024 via the introduction of a restricted role and the removal of automatic API key generation on installation of an agent.
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H
Affected products
Rapid7 · Insight AgentRelated CVEs — Rapid7 Insight Agent
In the same product, most dangerous first.
CVE-2019-5629HIGHCVE-2019-5629EPSS 0.9%CVE-2023-2273MEDIUMRapid7 Insight Agent Directory TraversalEPSS 0.7%CVE-2022-0237MEDIUMRapid7 Insight Agent Privilege EscalationEPSS 0.5%CVE-2026-4837MEDIUMEval Injection in Rapid7 Insight AgentEPSS 0.4%CVE-2021-4007HIGHRapid7 Insight Agent Privilege EscalationEPSS 0.3%CVE-2021-4016MEDIUMRapid7 Insight Agent Improper Access ControlEPSS 0.2%