Read the docs
TI-2024-02557 Aliases CVE-2024-2745GHSA-x4xh-mr6x-3f7c

Rapid7 InsightVM Sensitive Information Exposure via URL

Priority LOW 15CWE-598Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Rapid7's InsightVM maintenance mode login page suffers from a sensitive information exposure vulnerability whereby, sensitive information is exposed through query strings in the URL when login is attempted before the page is fully loaded.  This vulnerability allows attackers to acquire sensitive information such as passwords, auth tokens, usernames etc.     The vulnerability is remediated in version 6.6.244.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00181 7th percentileScored 2026-11-07
Fix Fixed InsightVM (Rapid7): 6.6.244

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Rapid7InsightVMbefore 6.6.2446.6.244Patch availableCNA
  • InsightVM VendorRapid7 Affected before 6.6.244 Fixed in 6.6.244 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:rapid7:insightvm:*:*:*:*:*:*:*:*before 6.6.244VulnerableRapid7
  • cpe:2.3:a:rapid7:insightvm:*:*:*:*:*:*:*:* Versions before 6.6.244 Vulnerable ·Rapid7

Remediation

  • Fix · CNA InsightVM (Rapid7) Fixed in 6.6.244

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-2745
  2. 2026-10-03 Alias added: GHSA-x4xh-mr6x-3f7c

References

Other 1

  • TI-2017-03353 Rapid7 Nexpose Virtual Appliance Duplicate SSH Host Key CVSS 3.1HIGH 7.7
  • TI-2019-03980 Rapid7 InsightVM Stored Credential Exposure CVSS 3.1MEDIUM 6.5
  • TI-2022-03902 Rapid7 Nexpose Update Validation Issue CVSS 3.1MEDIUM 6.5
  • TI-2021-02775 Rapid7 InsightVM Insufficient Session Expiration CVSS 3.1MEDIUM 5.7
  • TI-2023-00644 Rapid7 Nexpose Uncontrolled URL Redirect CVSS 3.1MEDIUM 6.1
  • TI-2024-06032 Rapid7 InsightVM Protection Mechanism Failure CVSS 3.1MEDIUM 5.3
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences