CVE-2021-4016: Rapid7 Insight Agent Improper Access Control
Rapid7 Insight Agent, versions prior to 3.1.3, suffer from an improper access control vulnerability whereby, the user has access to the snapshot directory. An attacker can access, read and copy any of the files in this directory e.g. assetinfo.json or fileinfo.json, leading to a loss of confidentiality. This issue was fixed in Rapid7 Insight Agent 3.1.3.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-4016?
CVE-2021-4016 is an improper access control vulnerability in Rapid7 Insight Agent versions prior to 3.1.3.
How does CVE-2021-4016 affect Rapid7 Insight Agent?
CVE-2021-4016 allows an attacker to access, read, and copy files in the snapshot directory of Rapid7 Insight Agent.
What is the severity of CVE-2021-4016?
CVE-2021-4016 has a severity rating of medium with a score of 3.3.
How can an attacker exploit CVE-2021-4016?
An attacker can exploit CVE-2021-4016 by gaining access to the snapshot directory and copying sensitive files like asset_info.json or file_info.json.
How can I fix CVE-2021-4016?
To fix CVE-2021-4016, upgrade Rapid7 Insight Agent to version 3.1.3 or later.