PT-2024-21905 · Rapid7 · Rapid7 Insightvm

Sreenath Raghunath · Published 2024-04-02 · Updated 2025-02-25 · CVE-2024-2745

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Rapid7 InsightVM versions prior to 6.6.244

Description The maintenance mode login page of Rapid7 InsightVM suffers from a sensitive information exposure issue, where sensitive information such as passwords, auth tokens, and usernames are exposed through query strings in the URL when a login attempt is made before the page is fully loaded. This allows attackers to acquire sensitive information.

Recommendations For versions prior to 6.6.244, update to version 6.6.244 or later to remediate the vulnerability. As a temporary workaround, consider avoiding login attempts before the page is fully loaded to minimize the risk of sensitive information exposure. Restrict access to the maintenance mode login page until the update is applied.

Fix

Weakness Enumeration

CWE-598

Related Identifiers

CVE-2024-2745

Affected Products

Rapid7 Insightvm

References · 7

• https://osv.dev/vulnerability/CVE-2024-2745 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-2745 · Security Note
• https://t.me/cvenotify/112444 · Telegram Post
• https://twitter.com/CVEnew/status/1775105247897378939 · Twitter Post
• https://docs.rapid7.com/release-notes/insightvm/20240327 · Note
• https://t.me/cvenotify/75452 · Telegram Post
• https://twitter.com/oktsec/status/1778106138292060347 · Twitter Post