CVE-2021-4016
Rapid7 Insight Agent Improper Access Control
- State
- Published
- Severity
- 4.0 Medium
- Published
- Jan 21, 2022
- Updated
- Sep 16, 2024
- Reserved
- Nov 24, 2021
Description
Rapid7 Insight Agent, versions prior to 3.1.3, suffer from an improper access control vulnerability whereby, the user has access to the snapshot directory. An attacker can access, read and copy any of the files in this directory e.g. asset_info.json or file_info.json, leading to a loss of confidentiality. This issue was fixed in Rapid7 Insight Agent 3.1.3.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.0 Medium | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | rapid7 |
Weaknesses
- CWE-284 Improper Access Control
Affected Products
| Product | Versions |
|---|---|
Insight AgentRapid7 |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.