What’s Vulnerable › Vulnerabilities

CVE-2019-5641: Rapid7 InsightVM Information Disclosure after Logout

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-09-21 · updated 2026-06-17
• Weakness: CWE-200

Description

Rapid7 InsightVM suffers from an information exposure issue whereby, when the user's session has ended due to inactivity, an attacker can use the Inspect Element browser feature to remove the login panel and view the details available in the last webpage visited by previous user

Affected products

• Rapid7 InsightVM: through 6.6.160

References

• https://docs.rapid7.com/release-notes/insightvm/20220830/
• https://docs.rapid7.com/release-notes/insightvm/20220830/

Get alerted when CVE-2019-5641 or the next vulnerability affects your stack