CVE-2019-5641

low-risk
Published 2022-09-21

Rapid7 InsightVM suffers from an information exposure issue whereby, when the user's session has ended due to inactivity, an attacker can use the Inspect Element browser feature to remove the login panel and view the details available in the last webpage visited by previous user

Do I need to act?

-
0.13% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
3
CVSS 3.3/10 Low
LOCAL / LOW complexity

Affected Products (1)

Insightvm

Affected Vendors

Rapid7

References (2)

Vendor Advisory https://docs.rapid7.com/release-notes/insightvm/20220830/
Vendor Advisory https://docs.rapid7.com/release-notes/insightvm/20220830/
19
/ 100
low-risk
Severity 13/34 · Low
Exploitability 1/34 · Minimal
Exposure 5/34 · Minimal