CVE-2021-3844: Rapid7 InsightVM Insufficient Session Expiration
First published: Fri Mar 24 2023(Updated: )
Rapid7 InsightVM suffers from insufficient session expiration when an administrator performs a security relevant edit on an existing, logged on user. For example, if a user's password is changed by an administrator due to an otherwise unrelated credential leak, that user account's current session is still valid after the password change, potentially allowing the attacker who originally compromised the credential to remain logged in and able to cause further damage. This vulnerability is mitigated by the use of the Platform Login feature. This issue is related to CVE-2019-5638.
Credit: cve@rapid7.con
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Rapid7 InsightVM | <6.5.50 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this Rapid7 InsightVM vulnerability?
The vulnerability ID is CVE-2021-3844.
What is the severity of CVE-2021-3844?
The severity of CVE-2021-3844 is medium (5.4).
What software is affected by CVE-2021-3844?
Rapid7 InsightVM versions up to and excluding 6.5.50 are affected by CVE-2021-3844.
How can an attacker exploit CVE-2021-3844?
An attacker can exploit CVE-2021-3844 by performing a security relevant edit on an existing logged-in user's account after an administrator changes the user's password.
Are there any references available for CVE-2021-3844?
Yes, you can find more information about CVE-2021-3844 at the following references: [1](https://docs.rapid7.com/insightvm/enable-insightvm-platform-login), [2](https://www.cve.org/cverecord?id=CVE-2019-5638).
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/author
- agent/last-modified-date
- agent/title
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/rapid7
- canonical/rapid7 insightvm