MEDIUM
Rapid7 InsightVM Stored Credential Exposure
Published Apr 9, 2019
6.5
MEDIUMCVSS 3.1
EPSS 0.79%
Description
Users with Site-level permissions can access files containing the username-encrypted passwords of Security Console Global Administrators and clear-text passwords for restoring backups, as well as the salt for those passwords. Valid credentials are required to access these files and malicious users would still need to perform additional work to decrypt the credentials and escalate privileges. This issue affects: Rapid7 InsightVM versions 6.5.11 through 6.5.49.
Affected products
-
- Version 6.5.11StatusaffectedConstraints<6.5.11*
- Version 6.5.49StatusaffectedConstraints<=6.5.49
- Version
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
Vendor solution
Update the Security Console to version 6.5.50 or later.
Weaknesses (2)
References (1)
- https://help.rapid7.com/insightvm/en-us/release-notes/#6.5.50 x_refsource_CONFIRMVendor Advisory
| Link | Providers | Tags |
|---|---|---|
| https://help.rapid7.com/insightvm/en-us/release-notes/#6.5.50 | x_refsource_CONFIRMVendor Advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner rapid7
Published Apr 9, 2019
Updated Sep 17, 2024
Reserved Jan 7, 2019
Link CVE-2019-5615
CISA Vulnrichment
Updated n/a