CVE-2018-5559: Medium severity Rapid7 Komand vulnerability
In Rapid7 Komand version 0.41.0 and prior, certain endpoints that are able to list the always encrypted-at-rest connection data could return some configurations of connection data without obscuring sensitive data from the API response sent over an encrypted channel. This issue does not affect Rapid7 Komand version 0.42.0 and later versions.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2018-5559?
CVE-2018-5559 has been categorized with a moderate severity level due to the potential exposure of sensitive connection data.
How do I fix CVE-2018-5559?
To fix CVE-2018-5559, upgrade to Rapid7 Komand version 0.42.0 or later to ensure sensitive data is obscured in API responses.
What kind of data is affected by CVE-2018-5559?
CVE-2018-5559 affects certain endpoints that list always encrypted-at-rest connection data, potentially exposing sensitive configurations.
Does CVE-2018-5559 affect all versions of Rapid7 Komand?
CVE-2018-5559 specifically affects Rapid7 Komand version 0.41.0 and earlier versions.
Is CVE-2018-5559 resolved in later versions of Rapid7 Komand?
Yes, CVE-2018-5559 is resolved in Rapid7 Komand version 0.42.0 and later, addressing the data exposure issue.