PT-2021-19556 · Rapid7 · Rapid7 Nexpose

Reda El Hachloufi · Published 2021-08-19 · Updated 2021-08-26 · CVE-2021-31868

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Rapid7 Nexpose versions 6.6.95 and earlier

Description: The issue allows authenticated users of the Security Console to view and edit any ticket in the legacy ticketing feature, regardless of the assignment of the ticket. This was resolved in version 6.6.96.

Recommendations: For versions 6.6.95 and earlier, update to version 6.6.96 or later to resolve the issue. As a temporary workaround, consider restricting access to the legacy ticketing feature in the Security Console until the update is applied.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2021-31868

Affected Products

Rapid7 Nexpose

References · 6

• https://docs.rapid7.com/release-notes/nexpose/20210804 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-31868 · Security Note
• https://osv.dev/vulnerability/CVE-2021-31868 · Vendor Advisory
• https://t.me/cvenotify/20134 · Telegram Post
• https://t.me/cvenotify/19769 · Telegram Post
• https://t.me/cibsecurity/27612 · Telegram Post