CVE-2021-31868CWE-306

Rapid7 Nexpose Security Console Ticket Access Authentication Vulnerability

Medium · published August 19, 2021

CVSS v3.1
4.3
EPSS
0%
Percentile
40.0
In the wild
Unconfirmed
What it is

Rapid7 Nexpose version 6.6.95 and earlier allows authenticated users of the Security Console to view and edit any ticket in the legacy ticketing feature, regardless of the assignment of the ticket. This issue was resolved in version 6.6.96, released on August 4, 2021.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00474 · 40.0th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2021-08-19T15:25Z
EPSS history
Timeline
  • 19 AUG 15:25Z
    Rapid7 Nexpose Security Console Ticket Access Authentication Vulnerability
    cvelistv5