Rapid7 · Rapid7 Insight Platform · CVE-2024-11401
**Name of the Vulnerable Software and Affected Versions**
Rapid7 Insight Platform versions prior to November 13, 2024
**Description**
The issue is a privilege escalation vulnerability due to a lack of authorization checks. An attacker can update the password policy in the platform settings as a standard user by manipulating an API. This functionality was not possible through the platform's User Interface.
**Recommendations**
For versions prior to November 13, 2024, update to a version that includes the fix for this issue, as it has been corrected as of November 13, 2024. As a temporary workaround, consider restricting access to the API that allows password policy updates until a patch is applied.