CVE-2019-5615

Rapid7 InsightVM Stored Credential Exposure

State: Published
Severity: 3.1 Low
Published: Apr 9, 2019
Updated: Sep 17, 2024
Reserved: Jan 7, 2019

Description

Users with Site-level permissions can access files containing the username-encrypted passwords of Security Console Global Administrators and clear-text passwords for restoring backups, as well as the salt for those passwords. Valid credentials are required to access these files and malicious users would still need to perform additional work to decrypt the credentials and escalate privileges. This issue affects: Rapid7 InsightVM versions 6.5.11 through 6.5.49.

Scores

CVSS	Score	Vector	Source
3.0	3.1 Low	CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N	rapid7

Weaknesses

CWE-257

Affected Products

Product	Versions
InsightVMRapid7	6.5.49 through 6.5.49Affected 6.5.11 to before 6.5.11*Affected

References

https://help.rapid7.com/insightvm/en-us/release-notes/#6.5.50

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.