CVE-2021-3844: fallo de gravedad media en Rapid7 InsightVM
Rapid7 InsightVM Insufficient Session Expiration
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.7epss 0.4%
Rapid7 InsightVM suffers from insufficient session expiration when an administrator performs a security relevant edit on an existing, logged on user. For example, if a user's password is changed by an administrator due to an otherwise unrelated credential leak, that user account's current session is still valid after the password change, potentially allowing the attacker who originally compromised the credential to remain logged in and able to cause further damage. This vulnerability is mitigated by the use of the Platform Login feature. This issue is related to CVE-2019-5638.
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
Productos afectados
Rapid7 · InsightVMCVEs relacionadas — Rapid7 InsightVM
En el mismo producto, de las más peligrosas a las menos.
CVE-2019-5615LOWRapid7 InsightVM Stored Credential ExposureEPSS 0.8%CVE-2019-5641LOWRapid7 InsightVM Information Disclosure after LogoutEPSS 0.4%CVE-2022-4261MEDIUMRapid7 Nexpose Update Validation IssueEPSS 0.3%CVE-2024-6504MEDIUMRapid7 InsightVM Protection Mechanism FailureEPSS 0.3%CVE-2022-3913MEDIUMRapid7 Nexpose Certificate Validation IssueEPSS 0.3%CVE-2024-2745LOWRapid7 InsightVM Sensitive Information Exposure via URLEPSS 0.2%