CVE-2024-3185
Last modified
CVE-2024-3185 is a medium-severity vulnerability rated 6.8/10 on the CVSS scale. A key used in logging.json does not follow the least privilege principle by default and is exposed to local users in the Rapid7 Platform. This allows an attacker with local access to a machine with the logging.json file to use that key to authenticate to the platform with high privileges. EPSS estimates a 0.17% chance of exploitation in the next 30 days.
Description
A key used in logging.json does not follow the least privilege principle by default and is exposed to local users in the Rapid7 Platform. This allows an attacker with local access to a machine with the logging.json file to use that key to authenticate to the platform with high privileges. This was fixed in the Rapid7 platform starting 3 April 2024 via the introduction of a restricted role and the removal of automatic API key generation on installation of an agent.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2024-3185?
How severe is CVE-2024-3185?
How do I fix CVE-2024-3185?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-31844An issue was discovered in Italtel Embrace 1.6.4. The server…5.3
- CVE-2024-31845An issue was discovered in Italtel Embrace 1.6.4. The produc…5.3
- CVE-2024-31846An issue was discovered in Italtel Embrace 1.6.4. The web ap…7.5
- CVE-2024-31847An issue was discovered in Italtel Embrace 1.6.4. A stored c…6.1
- CVE-2024-31848A path traversal vulnerability exists in the Java version of…9.8
- CVE-2024-31849A path traversal vulnerability exists in the Java version of…9.8
- CVE-2024-31850A path traversal vulnerability exists in the Java version of…8.6
- CVE-2024-31851A path traversal vulnerability exists in the Java version of…8.6
- CVE-2024-31852LLVM before 18.1.3 generates code in which the LR register c…5.9
- CVE-2024-31853A vulnerability has been identified in SICAM TOOLBOX II (All…8.1
- CVE-2024-31854A vulnerability has been identified in SICAM TOOLBOX II (All…8.1
- CVE-2024-31856An attacker with certain MQTT permissions can create malicio…8.8
Are you affected by CVE-2024-3185?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST