Rapid7 vulnerabilities, page 4

138 vulnerabilities

Known vulnerabilities in Rapid7 products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 45 products.

3.1LowCVE-2024-8042rapid7 · insight_platformRapid7 Insight Platform Unauthorized Empty Group CreationRapid7 Insight Platform versions between November 2019 and August 14, 2024 suffer from missing authorization issues whereby an attacker can intercept local requests to set the name and description of a new user group. This could potentially lead to an empty user group being added to the incorrect customer. This vulnerability is remediated as of August 14, 2024.EPSS0.18%6.8MediumCVE-2024-3185rapid7 · insight_agentRapid7 Insight Agent Sensitive Key Exposed To Local UsersA key used in logging.json does not follow the least privilege principle by default and is exposed to local users in the Rapid7 Platform. This allows an attacker with local access to a machine with the logging.json file to use that key to authenticate to the platform with high privileges. This was fixed in the Rapid7 platform starting 3 April 2024 via the introduction of a restricted role and the removal of automatic API key generation on installation of an agent.EPSS0.17%9.3CriticalCVE-2019-5631rapid7 · insightappsecRapid7 InsightAppSec Local Privilege EscalationThe Rapid7 InsightAppSec broker suffers from a DLL injection vulnerability in the 'prunsrv.exe' component of the product. If exploited, a local user of the system (who must already be authenticated to the operating system) can elevate their privileges with this vulnerability to the privilege level of InsightAppSec (usually, SYSTEM). This issue affects version 2019.06.24 and prior versions of the product.EPSS1.06%5.3MediumCVE-2019-5641rapid7 · insightvmRapid7 InsightVM Information Disclosure after LogoutRapid7 InsightVM suffers from an information exposure issue whereby, when the user's session has ended due to inactivity, an attacker can use the Inspect Element browser feature to remove the login panel and view the details available in the last webpage visited by previous userEPSS0.39%7.4HighCVE-2019-5624rapid7 · metasploit +1 moreRapid7 Metasploit Framework Zip Import Directory TraversalRapid7 Metasploit Framework suffers from an instance of CWE-22, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in the Zip import function of Metasploit. Exploiting this vulnerability can allow an attacker to execute arbitrary code in Metasploit at the privilege level of the user running Metasploit. This issue affects: Rapid7 Metasploit Framework version 4.14.0 and prior versions.EPSS2.76%7.5HighCVE-2019-5645rapid7 · metasploit +1 moreRapid7 Metasploit HTTP Handler Denial of ServiceBy sending a specially crafted HTTP GET request to a listening Rapid7 Metasploit HTTP handler, an attacker can register an arbitrary regular expression. When evaluated, this malicious handler can either prevent new HTTP handler sessions from being established, or cause a resource exhaustion on the Metasploit server.EPSS41.69%8.8HighCVE-2019-5630rapid7 · nexpose +1 moreRapid7 Nexpose/InsightVM Security Console CSRFA Cross-Site Request Forgery (CSRF) vulnerability was found in Rapid7 Nexpose InsightVM Security Console versions 6.5.0 through 6.5.68. This issue allows attackers to exploit CSRF vulnerabilities on API endpoints using Flash to circumvent a cross-domain pre-flight OPTIONS request.EPSS0.89%7.8HighCVE-2019-5629rapid7 · insight_agentrapid7 insight_agentRapid7 Insight Agent, version 2.6.3 and prior, suffers from a local privilege escalation due to an uncontrolled DLL search path. Specifically, when Insight Agent 2.6.3 and prior starts, the Python interpreter attempts to load python3.dll at "C:\DLLs\python3.dll," which normally is writable by locally authenticated users. Because of this, a malicious local user could use Insight Agent's startup conditions to elevate to SYSTEM privileges. This issue was fixed in Rapid7 Insight Agent 2.6.4.EPSS0.94%8.7HighCVE-2019-5638rapid7 · nexposeRapid7 Nexpose Insufficient Session ManagementRapid7 Nexpose versions 6.5.50 and prior suffer from insufficient session expiration when an administrator performs a security relevant edit on an existing, logged on user. For example, if a user's password is changed by an administrator due to an otherwise unrelated credential leak, that user account's current session is still valid after the password change, potentially allowing the attacker who originally compromised the credential to remain logged in and able to cause further damage.EPSS0.83%5.3MediumCVE-2019-5640rapid7 · nexposeRapid7 Nexpose Information Disclosure after logoutRapid7 Nexpose versions prior to 6.6.114 suffer from an information exposure issue whereby, when the user's session has ended due to inactivity, an attacker can use the inspect element browser feature to remove the login panel and view the details available in the last webpage visited by previous userEPSS0.54%3.3LowCVE-2019-5642rapid7 · metasploit +1 moreMAGICKRapid7 Metasploit Pro version 4.16.0-2019081901 and prior suffers from an instance of CWE-732, wherein the unique server.key is written to the file system during installation with world-readable permissions. This can allow other users of the same system where Metasploit Pro is installed to intercept otherwise private communications to the Metasploit Pro web interface.EPSS0.31%7.1HighCVE-2019-5647rapid7 · appspiderRapid7 AppSpider Chrome Plugin Insufficient Session ExpirationThe Chrome Plugin for Rapid7 AppSpider can incorrectly keep browser sessions active after recording a macro, even after a restart of the Chrome browser. This behavior could make future session hijacking attempts easier, since the user could believe a session was closed when it was not. This issue affects Rapid7 AppSpider version 3.8.213 and prior versions, and is fixed in version 3.8.215.EPSS0.34%6.5MediumCVE-2019-5615rapid7 · insightvmRapid7 InsightVM Stored Credential ExposureUsers with Site-level permissions can access files containing the username-encrypted passwords of Security Console Global Administrators and clear-text passwords for restoring backups, as well as the salt for those passwords. Valid credentials are required to access these files and malicious users would still need to perform additional work to decrypt the credentials and escalate privileges. This issue affects: Rapid7 InsightVM versions 6.5.11 through 6.5.49.EPSS0.79%5.1MediumCVE-2026-16895rapid7 · metasploit-frameworkAuthentication Bypass in Metasploit JSON-RPC Service When DB Health Check FailsA logic vulnerability (fail-open condition) has been identified within the Metasploit Framework's JSON-RPC web service interface. When an exception occurs during the database health check (db.check) and the environment variable MSF_WS_JSON_RPC_API_TOKEN is not explicitly set, the application resets the internal state flag msf.auth_initialized to false. The ApiToken Warden authentication strategy misinterprets this false value as an indicator that authentication is not initialized or required, thereby granting unauthenticated local access to the JSON-RPC request dispatcher.EPSS0.16%3.6LowCVE-2026-77797rapid7 · velociraptorVelociraptor Prefetch parser out of boundsVelociraptor's prefetch library contains an out of bound vulnerability which may cause a crash when parsing certain malformed prefetch files.EPSS0.10%6.5MediumCVE-2026-77798rapid7 · velociraptorVelociraptor Authenticated Denial of ServiceVelociraptor contains a deadlock condition that may be triggered by authenticated users. The issue stems from a lock management bug in the user management module.EPSS0.20%9.6CriticalCVE-2026-1568rapid7 · vulnerability managementRapid7 InsightVM Signature Validation VulnerabilityRapid7 InsightVM versions before 8.34.0 contain a signature verification issue on the Assertion Consumer Service (ACS) cloud endpoint that could allow an attacker to gain unauthorized access to InsightVM accounts setup via "Security Console" installations, resulting in full account takeover. The issue occurs due to the application processing these unsigned assertions and issuing session cookies that granted access to the targeted user accounts. This has been fixed in version 8.34.0 of InsightVM.EPSS0.16%6.8MediumCVE-2026-1814rapid7 · insightvm/nexposeRapid7 Nexpose Insecure Java Keystore Password GenerationRapid7 Nexpose versions 6.4.50 and later are vulnerable to an insufficient entropy issue in the CredentialsKeyStorePassword.generateRandomPassword() method. When updating legacy keystore passwords, the application generates a new password with insufficient length (7-12 characters) and a static prefix 'p', resulting in a weak keyspace. An attacker with access to the nsc.ks file can brute-force this password using consumer-grade hardware to decrypt stored credentials.EPSS0.16%8.9HighCVE-2026-19200rapid7 · velociraptorVelociraptor Analyst overwrites live built-in artifacts through verify()The Velociraptor verify() VQL function allows a user to verify an artifact for syntatic and other issues. Due to an implementation fault in this VQL function, the global artifact repository is used which allows callers to overwrite existing artifacts without the required permissions.  The attacker need only have the NOTEBOOK_EDIT permission (e.g. an analyst role) to be able to call this function.EPSS0.23%7.7HighCVE-2026-19584rapid7 · velociraptorVelociraptor VQL injection during notebook restore from backupVelociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell content is interpolated into a template with no ACL checks. This allows a malicious user with NOTEBOOK_EDITOR permission to plant a VQL query which will be evaluated at elevated permissions if the notebook's backup is subsequently restored.EPSS0.19%