CVE-2024-2745
Last modified
CVE-2024-2745 is a low-severity vulnerability rated 3.3/10 on the CVSS scale. Rapid7's InsightVM maintenance mode login page suffers from a sensitive information exposure vulnerability whereby, sensitive information is exposed through query strings in the URL when login is attempted before the page is fully loaded. This vulnerability allows attackers to acquire sensitive information such as passwords, auth tokens, usernames etc. The vulnerability is remediated in version 6.6.244. . EPSS estimates a 0.18% chance of exploitation in the next 30 days.
Description
Rapid7's InsightVM maintenance mode login page suffers from a sensitive information exposure vulnerability whereby, sensitive information is exposed through query strings in the URL when login is attempted before the page is fully loaded. This vulnerability allows attackers to acquire sensitive information such as passwords, auth tokens, usernames etc. The vulnerability is remediated in version 6.6.244.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Rapid7 | Insightvm | < 6.6.244 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-2745?
How severe is CVE-2024-2745?
How do I fix CVE-2024-2745?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-27441Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2024-27442An issue was discovered in Zimbra Collaboration (ZCS) 9.0 an…7.8
- CVE-2024-27443An issue was discovered in Zimbra Collaboration (ZCS) 9.0 an…6.1
- CVE-2024-27444langchain_experimental (aka LangChain Experimental) in LangC…9.8
- CVE-2024-27447pretix before 2024.1.1 mishandles file validation.9.8
- CVE-2024-27448MailDev 2 through 2.1.0 allows Remote Code Execution via a c…9.1
- CVE-2024-27453In Extreme XOS through 22.6.1.4, a read-only user can escala…8.6
- CVE-2024-27454orjson.loads in orjson before 3.9.15 does not limit recursio…7.5
- CVE-2024-27455In the Bentley ALIM Web application, certain configuration s…9.1
- CVE-2024-27456rack-cors (aka Rack CORS Middleware) 2.0.1 has 0666 permissi…9.1
- CVE-2024-27457Improper check for unusual or exceptional conditions in Inte…2.5
- CVE-2024-27458A potential security vulnerability has been identified in th…8.8
Are you affected by CVE-2024-2745?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST