CVE-2024-2745: Rapid7 InsightVM Sensitive Information Exposure via URL
Rapid7's InsightVM maintenance mode login page suffers from a sensitive information exposure vulnerability whereby, sensitive information is exposed through query strings in the URL when login is attempted before the page is fully loaded. This vulnerability allows attackers to acquire sensitive information such as passwords, auth tokens, usernames etc. The vulnerability is remediated in version 6.6.244.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-2745?
CVE-2024-2745 is considered a medium severity vulnerability due to the potential exposure of sensitive information during the login process.
How do I fix CVE-2024-2745?
To fix CVE-2024-2745, upgrade to Rapid7 InsightVM version 6.6.244 or later.
What type of vulnerability is CVE-2024-2745?
CVE-2024-2745 is a sensitive information exposure vulnerability affecting the InsightVM maintenance mode login page.
Who is affected by CVE-2024-2745?
CVE-2024-2745 affects users of Rapid7 InsightVM versions before 6.6.244.
What can attackers do with CVE-2024-2745?
Attackers could exploit CVE-2024-2745 to acquire sensitive information through query strings in the URL during the login process.