Insightvm
Monthly
Local privilege escalation in Rapid7 InsightVM, Nexpose, and the Insight Agent allows a low-privileged user to gain elevated code execution by planting an executable in a location the scanner discovers and runs during an authenticated assessment. Because the products execute discovered executables without validating file ownership (CWE-250), the planted code runs as the scan credential on Scan Engine or as root/SYSTEM under the Insight Agent, yielding full local compromise. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV, but the vendor-confirmed root/SYSTEM outcome makes this a meaningful escalation path.
Rapid7 InsightVM Console versions below 6.6.260 suffer from a protection mechanism failure whereby an attacker with network access to the InsightVM Console can cause it to overload or crash by. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Rapid7's InsightVM maintenance mode login page suffers from a sensitive information exposure vulnerability whereby, sensitive information is exposed through query strings in the URL when login is. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. No vendor patch available.
Rapid7 InsightVM versions 6.6.178 and lower suffers from an open redirect vulnerability, whereby an attacker has the ability to redirect the user to a site of the attacker’s choice using the ‘page’. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Rapid7 Nexpose and InsightVM versions prior to 6.6.172 failed to reliably validate the authenticity of update contents. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Users with Site-level permissions can access files containing the username-encrypted passwords of Security Console Global Administrators and clear-text passwords for restoring backups, as well as the. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Local privilege escalation in Rapid7 InsightVM, Nexpose, and the Insight Agent allows a low-privileged user to gain elevated code execution by planting an executable in a location the scanner discovers and runs during an authenticated assessment. Because the products execute discovered executables without validating file ownership (CWE-250), the planted code runs as the scan credential on Scan Engine or as root/SYSTEM under the Insight Agent, yielding full local compromise. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV, but the vendor-confirmed root/SYSTEM outcome makes this a meaningful escalation path.
Rapid7 InsightVM Console versions below 6.6.260 suffer from a protection mechanism failure whereby an attacker with network access to the InsightVM Console can cause it to overload or crash by. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Rapid7's InsightVM maintenance mode login page suffers from a sensitive information exposure vulnerability whereby, sensitive information is exposed through query strings in the URL when login is. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. No vendor patch available.
Rapid7 InsightVM versions 6.6.178 and lower suffers from an open redirect vulnerability, whereby an attacker has the ability to redirect the user to a site of the attacker’s choice using the ‘page’. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Rapid7 Nexpose and InsightVM versions prior to 6.6.172 failed to reliably validate the authenticity of update contents. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Users with Site-level permissions can access files containing the username-encrypted passwords of Security Console Global Administrators and clear-text passwords for restoring backups, as well as the. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.