CVE-2024-2745lowCWE-598

CVE-2024-2745: falha de baixa gravidade em Rapid7 InsightVM

Rapid7 InsightVM Sensitive Information Exposure via URL

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar InsightVM

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 3.3epss 0.2%
Rapid7's InsightVM maintenance mode login page suffers from a sensitive information exposure vulnerability whereby, sensitive information is exposed through query strings in the URL when login is attempted before the page is fully loaded.  This vulnerability allows attackers to acquire sensitive information such as passwords, auth tokens, usernames etc.     The vulnerability is remediated in version 6.6.244. 
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
Rapid7 · InsightVM
CVEs relacionadas — Rapid7 InsightVM

No mesmo produto, das mais perigosas para as menos.

CVE-2019-5615LOWRapid7 InsightVM Stored Credential ExposureEPSS 0.8%CVE-2019-5641LOWRapid7 InsightVM Information Disclosure after LogoutEPSS 0.4%CVE-2021-3844MEDIUMRapid7 InsightVM Insufficient Session ExpirationEPSS 0.4%CVE-2022-4261MEDIUMRapid7 Nexpose Update Validation IssueEPSS 0.3%CVE-2024-6504MEDIUMRapid7 InsightVM Protection Mechanism FailureEPSS 0.3%CVE-2022-3913MEDIUMRapid7 Nexpose Certificate Validation IssueEPSS 0.3%