Rapid7 Nexpose Insufficient Session Management
CVE-2019-5638

8.7HIGH

Key Information:

Vendor

Rapid7

Status
Nexpose
Vendor
CVE Published:
21 August 2019

What is CVE-2019-5638?

Rapid7 Nexpose versions 6.5.50 and prior suffer from insufficient session expiration when an administrator performs a security relevant edit on an existing, logged on user. For example, if a user's password is changed by an administrator due to an otherwise unrelated credential leak, that user account's current session is still valid after the password change, potentially allowing the attacker who originally compromised the credential to remain logged in and able to cause further damage.

Affected Version(s)

Nexpose <= 6.5.50

References

https://help.rapid7.com/nexpose/en-us/release-notes/archi...
x_refsource_CONFIRM
https://docs.rapid7.com/insightvm/enable-insightvm-platfo...
vendor-advisory

CVSS V3.1

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This issue was discovered, and reported to Rapid7, by independent researcher Ashutosh Barot. It is being disclosed in accordance with Rapid7's vulnerability disclosure policy (https://www.rapid7.com/disclosure/).
.