TI-2024-00358 Aliases CVE-2024-0394 GHSA-5q37-x55w-w66j

Rapid7 Minerva Armor Privilege Escalation

HIGH 69CWE-862Published 2024-04-03 · Updated 2024-08-22

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

Rapid7 Minerva Armor versions below 4.5.5 suffer from a privilege escalation vulnerability whereby an authenticated attacker can elevate privileges and execute arbitrary code with SYSTEM privilege. The vulnerability is caused by the product's implementation of OpenSSL's`OPENSSLDIR` parameter where it is set to a path accessible to low-privileged users. The vulnerability has been remediated and fixed in version 4.5.5.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00234 14th percentileScored 2026-11-07

Fix Fixed Minerva (Rapid7): 4.5.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Rapid7	Minerva	before 4.5.5	4.5.5	Patch available	CNA

Minerva VendorRapid7 Affected before 4.5.5 Fixed in 4.5.5 Patch available CNA

CPE names CISA-ADP · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:rapid7:minerva_armor::::::::	—	—	Rapid7

cpe:2.3:a:rapid7:minerva_armor:*:*:*:*:*:*:*:* Versions — — ·Rapid7

Remediation

Fix · CNA Minerva (Rapid7) Fixed in 4.5.5

Timeline

2026-10-02 Threatist record created from CVE-2024-0394
2026-10-03 Alias added: GHSA-5q37-x55w-w66j

References

Other 1

https://www.rapid7.com/blog/post/2024/04/03/cve-2024-0394-rapid7-minerva-armor-privilege-escalation-fixed/

TI-2023-01233 Rapid7 InsightCloudSec resource.db() method access CVSS 3.1HIGH 8.8
TI-2023-01231 Rapid7 InsightCloudSec getattr() method access CVSS 3.1HIGH 8.8
TI-2023-01232 Rapid7 InsightCloudSec box object access CVSS 3.1HIGH 8.1
TI-2024-02985 Rapid7 Insight Agent Sensitive Key Exposed To Local Users CVSS 3.1MEDIUM 6.8
TI-2019-04008 Rapid7 Metasploit HTTP Handler Denial of Service CVSS 3.1HIGH 7.5
TI-2020-05967 Client-Side Command Injection in Rapid7 Metasploit CVSS 3.1HIGH 7.8

See all 139 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences