CVE-2021-4016
Assigner: rapid7
Published: 2022-01-19T00:00:00
State: PUBLISHED
affected: product: Insight Agent
vendor: Rapid7
versions: lessThan: 3.1.3
status: affected
version: 3.1.3
versionType: custom
credits: value: Andreas Welcker
datePublic: 2022-01-19T00:00:00
descriptions: value: Rapid7 Insight Agent, versions prior to 3.1.3, suffer from an improper access control vulnerability whereby, the user has access to the snapshot directory. An attacker can access, read and copy any of the files in this directory e.g. asset_info.json or file_info.json, leading to a loss of confidentiality. This issue was fixed in Rapid7 Insight Agent 3.1.3.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
problemTypes: descriptions: cweId: CWE-284
description: CWE-284 Improper Access Control
type: CWE
source: discovery: UNKNOWN
title: Rapid7 Insight Agent Improper Access Control
x_generator: engine: Vulnogram 0.0.9