PT-2024-37675 · Rapid7 · Rapid7 Insightvm Console

Published 2024-07-18 · Updated 2025-09-05 · CVE-2024-6504

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Rapid7 InsightVM Console versions prior to 6.6.261

Description The issue is related to a protection mechanism failure, where an attacker with network access can cause the console to overload or crash by sending repeated invalid REST requests to the Console's port 443, leading to an exception handling logging loop that exhausts the CPU. There is no indication that this method can be used to escalate privilege, acquire unauthorized access to data, or gain control of protected resources.

Recommendations For versions prior to 6.6.261, update to version 6.6.261 to resolve the issue. As a temporary workaround, consider restricting access to port 443 to minimize the risk of exploitation.

Fix

Protection Mechanism Failure

Allocation of Resources Without Limits

Weakness Enumeration

CWE-693

CWE-770

Related Identifiers

CVE-2024-6504

Affected Products

Rapid7 Insightvm Console

References · 7

• https://docs.rapid7.com/release-notes/insightvm/20240717 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-6504 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-6504 · Security Note
• https://t.me/cvenotify/93954 · Telegram Post
• https://t.me/cvenotify/86604 · Telegram Post
• https://t.me/cvedetector/1149 · Telegram Post
• https://t.me/cveNotify/134370 · Telegram Post