Insight Platform CVEs and Security Vulnerabilities

CVE-2024-11401

Rapid7 Insight Platform Privilege Escalation Vulnerability

Rapid7 Insight Platform versions prior to November 13th 2024, suffer from a privilege escalation vulnerability whereby, due to a lack of authorization checks, an attacker can successfully update the password policy in the platform settings as a standard user by crafting an API (the functionality was not possible through the platform's User Interface). This vulnerability has been fixed as of November 13th 2024.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Rapid7

Products

Insight Platform

CVE-2024-8042

Rapid7 Insight Platform Unauthorized Empty Group Creation

Rapid7 Insight Platform versions between November 2019 and August 14, 2024 suffer from missing authorization issues whereby an attacker can intercept local requests to set the name and description of a new user group. This could potentially lead to an empty user group being added to the incorrect customer. This vulnerability is remediated as of August 14, 2024.

CVSS 3.1 · 2.4 Low EPSS < 1% KEV · Not listed