Login Request a demo
Low severity · published Apr 2, 2024
CVE-2024-2745
Rapid7 InsightVM Sensitive Information Exposure via URL
3.3
CVSS
0.2%
EPSS
No
On KEV
Description
Rapid7's InsightVM maintenance mode login page suffers from a sensitive information exposure vulnerability whereby, sensitive information is exposed through query strings in the URL when login is attempted before the page is fully loaded.  This vulnerability allows attackers to acquire sensitive information such as passwords, auth tokens, usernames etc.     The vulnerability is remediated in version 6.6.244. 
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IN
InsightVM · Rapid7
before 6.6.244 · source: vendor, NVD
Affected product
IN
InsightVM
Rapid7
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-2745
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-2745
Release Notes
https://docs.rapid7.com/release-notes/insightvm/20240327/
More from InsightVM
7.8
CVE-2026-14172
Rapid7 InsightVM, Nexpose, and Insight Agent Local Privilege Escalation via Unvalidated Executable Invocation
7.7
CVE-2017-5242
Nexpose and InsightVM virtual appliances downloaded between April 5th, 2017 and May 3rd, 2017 contain identical SSH host keys
6.8
CVE-2024-3185
Rapid7 Insight Agent Sensitive Key Exposed To Local Users
6.5
CVE-2022-4261
Rapid7 Nexpose and InsightVM versions prior to 6.6.172 failed to reliably validate the authenticity of update contents
6.5
CVE-2019-5615
Users with Site-level permissions can access files containing the username-encrypted passwords of Security Console Global Administrators and clear-text passwords for restoring…