CVE-2018-5559: rapid7 komand
Vulnerability summary
CVE-2018-5559 is a medium (CVSS 4.9) vulnerability in rapid7 komand. EPSS estimates a 0.62% chance of exploitation in the next 30 days, higher than 49% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 28-11-2018PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
In Rapid7 Komand version 0.41.0 and prior, certain endpoints that are able to list the always encrypted-at-rest connection data could return some configurations of connection data without obscuring sensitive data from the API response sent over an encrypted channel. This issue does not affect Rapid7 Komand version 0.42.0 and later versions.
CVSS metrics
3 scores · 2 sources · 2 versions- CVE.orgCNA3.4LowCVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:NDiffers
EPSS trend
Probability
0.62%
Chance of exploitation in the next 30 days
Percentile
49%
Versus all other CVEs
30-day change
+0.06 pp
From 0.56% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (alexanderjaeger.de)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-212Improper Removal of Sensitive Information Before Storage or TransferThe product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.
- CWE-312Cleartext Storage of Sensitive InformationThe product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
Affected systems
Rapid71 product
- komand0.41.0 | ≤ 0.41.0
1 vendor · 1 product