CVE-2019-5640
Rapid7 Nexpose Information Disclosure after logout
- State
- Published
- Severity
- 3.3 Low
- Published
- Nov 22, 2021
- Updated
- Sep 17, 2024
- Reserved
- Jan 7, 2019
Description
Rapid7 Nexpose versions prior to 6.6.114 suffer from an information exposure issue whereby, when the user's session has ended due to inactivity, an attacker can use the inspect element browser feature to remove the login panel and view the details available in the last webpage visited by previous user
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 3.3 Low | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | rapid7 |
Weaknesses
- CWE-200 Information Exposure
Affected Products
| Product | Versions |
|---|---|
NexposeRapid7 |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.