What’s Vulnerable › Vulnerabilities

CVE-2019-5640: Rapid7 Nexpose Information Disclosure after logout

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-11-22 · updated 2026-06-17
• Weakness: CWE-200

Description

Rapid7 Nexpose versions prior to 6.6.114 suffer from an information exposure issue whereby, when the user's session has ended due to inactivity, an attacker can use the inspect element browser feature to remove the login panel and view the details available in the last webpage visited by previous user

Affected products

• Rapid7 Nexpose: before 6.6.114 — fixed in 6.6.114

How to fix

Upgrade to a fixed version: Rapid7 Nexpose 6.6.114. Check the vendor advisory for mitigations.

References

• https://docs.rapid7.com/release-notes/nexpose/20211117/
• https://docs.rapid7.com/release-notes/nexpose/20211117/

Get alerted when CVE-2019-5640 or the next vulnerability affects your stack