Riskcovery

CVE-2018-5559

State
Published
Severity
3.4 Low
Published
Nov 28, 2018
Updated
Sep 17, 2024
Reserved
Jan 12, 2018

Read the record on cve.org

Description

In Rapid7 Komand version 0.41.0 and prior, certain endpoints that are able to list the always encrypted-at-rest connection data could return some configurations of connection data without obscuring sensitive data from the API response sent over an encrypted channel. This issue does not affect Rapid7 Komand version 0.42.0 and later versions.

Scores

CVSSScoreVectorSource
3.03.4 LowCVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:Nrapid7

Weaknesses

Affected Products

ProductVersions
KomandRapid7
  • 0.41.0 through 0.41.0Affected
  • 0.42.0 to before 0.42.0*Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.