CVE-2021-31868 MEDIUM

CVE-2021-31868: Rapid7 Nexpose Security Console Ticket Access Authentication Vulnerability

Vendor Rapid7
Product Nexpose
Weakness CWE-306 · Missing auth
Published August 19, 2021
Last update September 17, 2024
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Rapid7 Nexpose version 6.6.95 and earlier allows authenticated users of the Security Console to view and edit any ticket in the legacy ticketing feature, regardless of the assignment of the ticket. This issue was resolved in version 6.6.96, released on August 4, 2021.

Key dates

02Disclosure timeline

August 19, 2021 CVE published
September 17, 2024 Record updated