CVE-2021-31868: Rapid7 Nexpose Security Console Ticket Access Authentication Vulnerability

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-08-19 · updated 2026-06-17
Weakness: CWE-306

Description

Rapid7 Nexpose version 6.6.95 and earlier allows authenticated users of the Security Console to view and edit any ticket in the legacy ticketing feature, regardless of the assignment of the ticket. This issue was resolved in version 6.6.96, released on August 4, 2021.

Affected products

Rapid7 Nexpose: before 6.6.96 — fixed in 6.6.96

How to fix

Upgrade to a fixed version: Rapid7 Nexpose 6.6.96. Check the vendor advisory for mitigations.

References

https://docs.rapid7.com/release-notes/nexpose/20210804/
https://docs.rapid7.com/release-notes/nexpose/20210804/

Get alerted when CVE-2021-31868 or the next vulnerability affects your stack