CVE-2024-11401: Rapid7 Insight Platform Privilege Escalation Vulnerability
Rapid7 Insight Platform versions prior to November 13th 2024, suffer from a privilege escalation vulnerability whereby, due to a lack of authorization checks, an attacker can successfully update the password policy in the platform settings as a standard user by crafting an API (the functionality was not possible through the platform's User Interface). This vulnerability has been fixed as of November 13th 2024.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-11401?
CVE-2024-11401 has been classified as a high-severity privilege escalation vulnerability.
How do I fix CVE-2024-11401?
The best way to mitigate CVE-2024-11401 is to update to the Rapid7 Insight Platform version released after November 13th, 2024.
Who is affected by CVE-2024-11401?
CVE-2024-11401 affects all versions of Rapid7 Insight Platform prior to November 13th, 2024.
What is the nature of the issue in CVE-2024-11401?
CVE-2024-11401 is caused by a lack of proper authorization checks, allowing standard users to update the password policy.
How can attackers exploit CVE-2024-11401?
Attackers can exploit CVE-2024-11401 by crafting an API call to change password policies without necessary permissions.