CVE-2024-6504: Rapid7 InsightVM Protection Mechanism Failure
Rapid7 InsightVM Console versions below 6.6.260 suffer from a protection mechanism failure whereby an attacker with network access to the InsightVM Console can cause it to overload or crash by sending repeated invalid REST requests in a short timeframe, to the Console's port 443 causing the console to enter an exception handling logging loop, exhausting the CPU. There is no indication that an attacker can use this method to escalate privilege, acquire unauthorized access to data, or gain control of protected resources. This issue is fixed in version 6.6.261.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Rapid7 InsightVM Consoleto a version that resolves this vulnerability.Fixed in 6.6.261
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6504?
CVE-2024-6504 is considered a high-severity vulnerability due to its potential to enable an attacker to crash the Rapid7 InsightVM Console.
How do I fix CVE-2024-6504?
To fix CVE-2024-6504, upgrade the Rapid7 InsightVM Console to version 6.6.261 or later.
What versions of Rapid7 InsightVM are affected by CVE-2024-6504?
CVE-2024-6504 affects all versions of Rapid7 InsightVM Console below 6.6.261.
What type of attack does CVE-2024-6504 facilitate?
CVE-2024-6504 allows an attacker to overload or crash the InsightVM Console by sending multiple invalid REST requests.
Who is impacted by CVE-2024-6504?
Organizations using Rapid7 InsightVM Console versions below 6.6.261 are impacted by CVE-2024-6504.