What’s Vulnerable › Vulnerabilities

CVE-2021-4016: Rapid7 Insight Agent Improper Access Control

• Severity: low (CVSS 3.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-01-21 · updated 2026-06-17
• Weakness: CWE-284

Description

Rapid7 Insight Agent, versions prior to 3.1.3, suffer from an improper access control vulnerability whereby, the user has access to the snapshot directory. An attacker can access, read and copy any of the files in this directory e.g. asset_info.json or file_info.json, leading to a loss of confidentiality. This issue was fixed in Rapid7 Insight Agent 3.1.3.

Affected products

• Rapid7 Insight Agent: before 3.1.3 — fixed in 3.1.3

How to fix

Upgrade to a fixed version: Rapid7 Insight Agent 3.1.3. Check the vendor advisory for mitigations.

References

• https://docs.rapid7.com/release-notes/insightagent/20220119/
• https://docs.rapid7.com/release-notes/insightagent/20220119/

Get alerted when CVE-2021-4016 or the next vulnerability affects your stack