CVE-2024-11401CWE-862

Rapid7 Insight Platform Privilege Escalation Vulnerability

Medium · published December 11, 2024

CVSS v4.0
5.3
EPSS
0%
Percentile
25.8
In the wild
Unconfirmed
What it is

Rapid7 Insight Platform versions prior to November 13th 2024, suffer from a privilege escalation vulnerability whereby, due to a lack of authorization checks, an attacker can successfully update the password policy in the platform settings as a standard user by crafting an API (the functionality was not possible through the platform's User Interface). This vulnerability has been fixed as of November 13th 2024.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00337 · 25.8th percentile
Weakness
CWE-862 · Missing Authorization
Published
2024-12-11T09:46Z
EPSS history
Timeline
  • 11 DEC 09:46Z
    Rapid7 Insight Platform Privilege Escalation Vulnerability
    cvelistv5