Rapid7 vulnerabilities, page 3
138 vulnerabilities
Known vulnerabilities in Rapid7 products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 45 products.
HighCVE-2017-5242rapid7 · insightvm +2 moreRapid7 Nexpose Virtual Appliance Duplicate SSH Host KeyNexpose and InsightVM virtual appliances downloaded between April 5th, 2017 and May 3rd, 2017 contain identical SSH host keys. Normally, a unique SSH host key should be generated the first time a virtual appliance boots.EPSS0.38%HighCVE-2017-5240rapid7 · appspider_prorapid7 appspider_proEditions of Rapid7 AppSpider Pro prior to version 6.14.060 contain a heap-based buffer overflow in the FLAnalyzer.exe component. A malicious or malformed Flash source file can cause a denial of service condition when parsed by this component, causing the application to crash.EPSS1.03%HighCVE-2017-5232rapid7 · nexposerapid7 nexposeAll editions of Rapid7 Nexpose installers prior to version 6.4.24 contain a DLL preloading vulnerability, wherein it is possible for the installer to load a malicious DLL located in the current working directory of the installer.EPSS0.77%HighCVE-2017-5228rapid7 · metasploitrapid7 metasploitAll editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory traversal vulnerability in the Meterpreter stdapi Dir.download() function. By using a specially-crafted build of Meterpreter, it is possible to write to an arbitrary directory on the Metasploit console with the permissions of the running Metasploit instance.EPSS1.22%HighCVE-2017-5231rapid7 · metasploitrapid7 metasploitAll editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory traversal vulnerability in the Meterpreter stdapi CommandDispatcher.cmd_download() function. By using a specially-crafted build of Meterpreter, it is possible to write to an arbitrary directory on the Metasploit console with the permissions of the running Metasploit instance.EPSS1.22%LowCVE-2017-5244rapid7 · metasploit +1 morerapid7 metasploitRoutes used to stop running Metasploit tasks (either particular ones or all tasks) allowed GET requests. Only POST requests should have been allowed, as the stop/stop_all routes change the state of the service. This could have allowed an attacker to stop currently-running Metasploit tasks by getting an authenticated user to execute JavaScript. As of Metasploit 4.14.0 (Update 2017061301), the routes for stopping tasks only allow POST requests, which validate the presence of a secret token to prevent CSRF attacks.EPSS0.72%HighCVE-2017-5264rapid7 · nexposerapid7 nexposeVersions of Nexpose prior to 6.4.66 fail to adequately validate the source of HTTP requests intended for the Automated Actions administrative web application, and are susceptible to a cross-site request forgery (CSRF) attack.EPSS2.75%HighCVE-2017-5234rapid7 · insight_collectorrapid7 insight_collectorRapid7 Insight Collector installers prior to version 1.0.16 contain a DLL preloading vulnerability, wherein it is possible for the installer to load a malicious DLL located in the current working directory of the installer.EPSS0.91%HighCVE-2017-5243rapid7 · nexpose +1 morerapid7 nexposeThe default SSH configuration in Rapid7 Nexpose hardware appliances shipped before June 2017 does not specify desired algorithms for key exchange and other important functions. As a result, it falls back to allowing ALL algorithms supported by the relevant version of OpenSSH and makes the installations vulnerable to a range of MITM, downgrade, and decryption attacks.EPSS0.51%HighCVE-2017-5230rapid7 · nexposerapid7 nexposeThe Java keystore in all versions and editions of Rapid7 Nexpose prior to 6.4.50 is encrypted with a static password of 'r@p1d7k3y5t0r3' which is not modifiable by the user. The keystore provides storage for saved scan credentials in an otherwise secure location on disk.EPSS1.49%HighCVE-2017-5233rapid7 · appspider_prorapid7 appspider_proRapid7 AppSpider Pro installers prior to version 6.14.053 contain a DLL preloading vulnerability, wherein it is possible for the installer to load a malicious DLL located in the current working directory of the installer.EPSS0.88%HighCVE-2017-5235rapid7 · metasploit +1 morerapid7 metasploitRapid7 Metasploit Pro installers prior to version 4.13.0-2017022101 contain a DLL preloading vulnerability, wherein it is possible for the installer to load a malicious DLL located in the current working directory of the installer.EPSS0.91%HighCVE-2017-5236rapid7 · appspider_prorapid7 appspider_proEditions of Rapid7 AppSpider Pro installers prior to version 6.14.060 contain a DLL preloading vulnerability, wherein it is possible for the installer to load a malicious DLL located in the current working directory of the installer.EPSS0.93%HighCVE-2017-5229rapid7 · metasploitrapid7 metasploitAll editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory traversal vulnerability in the Meterpreter extapi Clipboard.parse_dump() function. By using a specially-crafted build of Meterpreter, it is possible to write to an arbitrary directory on the Metasploit console with the permissions of the running Metasploit instance.EPSS1.22%MediumCVE-2017-15084rapid7 · metasploitrapid7 metasploitThe web UI in Rapid7 Metasploit before 4.14.1-20170828 allows logout CSRF, aka R7-2017-22.EPSS1.49%LowCVE-2024-2745rapid7 · insightvmRapid7 InsightVM Sensitive Information Exposure via URLRapid7's InsightVM maintenance mode login page suffers from a sensitive information exposure vulnerability whereby, sensitive information is exposed through query strings in the URL when login is attempted before the page is fully loaded. This vulnerability allows attackers to acquire sensitive information such as passwords, auth tokens, usernames etc.
The vulnerability is remediated in version 6.6.244.EPSS0.18%MediumCVE-2024-11401rapid7 · insight_platformRapid7 Insight Platform Privilege Escalation VulnerabilityRapid7 Insight Platform versions prior to November 13th 2024, suffer from a privilege escalation vulnerability whereby, due to a lack of authorization checks, an attacker can successfully update the password policy in the platform settings as a standard user by crafting an API (the functionality was not possible through the platform's User Interface). This vulnerability has been fixed as of November 13th 2024.EPSS0.34%HighCVE-2024-0394rapid7 · minervaRapid7 Minerva Armor Privilege EscalationRapid7 Minerva Armor versions below 4.5.5 suffer from a privilege escalation vulnerability whereby an authenticated attacker can elevate privileges and execute arbitrary code with SYSTEM privilege. The vulnerability is caused by the product's implementation of OpenSSL's`OPENSSLDIR` parameter where it is set to a path accessible to low-privileged users. The vulnerability has been remediated and fixed in version 4.5.5.EPSS0.23%HighCVE-2024-10526rapid7 · velociraptorRapid7 Velociraptor Local Privilege Escalation In Windows Velociraptor ServiceRapid7 Velociraptor MSI Installer versions below 0.73.3 suffer from a vulnerability whereby it creates the installation directory with WRITE_DACL permission to the BUILTIN\\Users group. This allows local users who are not administrators to grant themselves the Full Control permission on Velociraptor's files. By modifying Velociraptor's files, local users can subvert the binary and cause the Velociraptor service to execute arbitrary code as the SYSTEM user, or to replace the Velociraptor binary completely. This issue is fixed in version 0.73.3.EPSS0.17%MediumCVE-2024-6504rapid7 · insightvmRapid7 InsightVM Protection Mechanism FailureRapid7 InsightVM Console versions below 6.6.260 suffer from a protection mechanism failure whereby an attacker with network access to the InsightVM Console can cause it to overload or crash by sending repeated invalid REST requests in a short timeframe, to the Console's port 443 causing the console to enter an exception handling logging loop, exhausting the CPU. There is no indication that an attacker can use this method to escalate privilege, acquire unauthorized access to data, or gain control of protected resources. This issue is fixed in version 6.6.261.EPSS0.32%