CVE-2024-8042
Low
Description
Rapid7 Insight Platform versions between November 2019 and August 14, 2024 suffer from missing authorization issues whereby an attacker can intercept local requests to set the name and description of a new user group. This could potentially lead to an empty user group being added to the incorrect customer. This vulnerability is remediated as of August 14, 2024.
SeverityLow
CVSS2.4
Exploit probability—
ProductRapid7 Insight Platform
PublishedSep 9, 2024
First seenSep 9, 2024
Weakness typeCWE-862Missing authorization
How to fix
Update
- rapid7 insight_platform2024-08-14 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rapid7 insight_platform | 2019-11-01 ≤ v < 2024-08-14 | 2024-08-14 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.