PT-2018-17047 · Rapid7 · Rapid7 Komand

Alex + 1 · Publicado 2018-11-28 · Atualizado 2019-10-09 · CVE-2018-5559

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Rapid7 Komand versions prior to 0.42.0

Description The issue concerns certain endpoints that can list always encrypted-at-rest connection data, potentially returning configurations without obscuring sensitive data in the API response.

Recommendations For versions prior to 0.42.0, update to version 0.42.0 or later to resolve the issue.

Exploit

Correção

Cleartext Storage of Sensitive Information

Enumeração de Fraquezas

CWE-312

CWE-212

Identificadores relacionados

CVE-2018-5559

Produtos afetados

Rapid7 Komand

Referências · 4

• 🔥 https://alexanderjaeger.de/cve-2018-5559_my_first_cve · Exploit
• https://osv.dev/vulnerability/CVE-2018-5559 · Aviso do Fabricante
• https://docs.komand.com/docs/release-notes#section-komand-v0-42-0-2018-11-1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-5559 · Nota de Segurança