VulnerabilityModified

CVE-2019-5615

Valid credentials are required to access these files and malicious users would still need to perform additional work to decrypt the credentials and escalate privileges.

MEDIUM 6.5EPSS 0.79%

Does this matter?

Lower severity and a low EPSS score (0.79%). Track it; it rarely justifies an emergency change on its own.

Description

Users with Site-level permissions can access files containing the username-encrypted passwords of Security Console Global Administrators and clear-text passwords for restoring backups, as well as the salt for those passwords. Valid credentials are required to access these files and malicious users would still need to perform additional work to decrypt the credentials and escalate privileges. This issue affects: Rapid7 InsightVM versions 6.5.11 through 6.5.49.

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.79% probability · 54th percentile
CISA KEV: Not listed
Weakness: CWE-257, CWE-522
Affected: rapid7/insightvm
Source: cve@rapid7.com

References

https://help.rapid7.com/insightvm/en-us/release-notes/#6.5.50Vendor Advisory
https://help.rapid7.com/insightvm/en-us/release-notes/#6.5.50Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.