CVE-2019-5640CWE-200

Rapid7 Nexpose Information Disclosure after logout

Low · published November 22, 2021

CVSS v3.1
3.3
EPSS
1%
Percentile
44.6
In the wild
Unconfirmed
What it is

Rapid7 Nexpose versions prior to 6.6.114 suffer from an information exposure issue whereby, when the user's session has ended due to inactivity, an attacker can use the inspect element browser feature to remove the login panel and view the details available in the last webpage visited by previous user

The record
Technical detail
CVSS v3.1
3.3 · LOW
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00539 · 44.6th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2021-11-22T16:35Z
EPSS history
Timeline
  • 22 NOV 16:35Z
    Rapid7 Nexpose Information Disclosure after logout
    cvelistv5