CVE-2021-4016

Rapid7 Insight Agent, versions prior to 3.1.3, suffer from an improper access control vulnerability whereby, the user has access to the snapshot directory. An attacker can access, read and copy any of the files in this directory e.g. asset_info.json or file_info.json, leading to a loss of confidentiality. This issue was fixed in Rapid7 Insight Agent 3.1.3.

CVSS v3 4.0 MEDIUM
CVSS v2.0 2.1 LOW

4.0^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.5 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://docs.rapid7.com/release-notes/insightagent/20220119/	Release Notes Third Party Advisory
https://docs.rapid7.com/release-notes/insightagent/20220119/	Release Notes Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:rapid7:insight_agent:*:*:*:*:*:*:*:*

History

21 Nov 2024, 06:36

Type	Values Removed	Values Added
CVSS	v2 : ~~2.1~~ v3 : ~~3.3~~	v2 : 2.1 v3 : 4.0
References	~~() https://docs.rapid7.com/release-notes/insightagent/20220119/ - Release Notes, Third Party Advisory~~	() https://docs.rapid7.com/release-notes/insightagent/20220119/ - Release Notes, Third Party Advisory

Information

Published : 2022-01-21 18:15

Updated : 2024-11-21 06:36

NVD link : CVE-2021-4016

Mitre link : CVE-2021-4016

CVE.ORG link : CVE-2021-4016

JSON object : View

Products Affected

rapid7

insight_agent

CWE

CWE-284

Improper Access Control

NVD-CWE-Other

{"id": "CVE-2021-4016", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@rapid7.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.0, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.5}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.8}]}, "published": "2022-01-21T18:15:08.303", "references": [{"url": "https://docs.rapid7.com/release-notes/insightagent/20220119/", "tags": ["Release Notes", "Third Party Advisory"], "source": "cve@rapid7.com"}, {"url": "https://docs.rapid7.com/release-notes/insightagent/20220119/", "tags": ["Release Notes", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "cve@rapid7.com", "description": [{"lang": "en", "value": "CWE-284"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Rapid7 Insight Agent, versions prior to 3.1.3, suffer from an improper access control vulnerability whereby, the user has access to the snapshot directory. An attacker can access, read and copy any of the files in this directory e.g. asset_info.json or file_info.json, leading to a loss of confidentiality. This issue was fixed in Rapid7 Insight Agent 3.1.3."}, {"lang": "es", "value": "Rapid7 Insight Agent, versiones anteriores a la 3.1.3, sufren una vulnerabilidad de control de acceso inapropiada por la cual, el usuario presenta acceso al directorio de instant\u00e1neas. Un atacante puede acceder, leer y copiar cualquiera de los archivos de este directorio, por ejemplo, asset_info.json o file_info.json, conllevando a una p\u00e9rdida de confidencialidad. Este problema se ha solucionado en Rapid7 Insight Agent versi\u00f3n 3.1.3"}], "lastModified": "2024-11-21T06:36:43.593", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:rapid7:insight_agent:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4682C876-3AF4-49B8-8333-AFE72AFACE45", "versionEndExcluding": "3.1.3"}], "operator": "OR"}]}], "sourceIdentifier": "cve@rapid7.com"}