CVE-2024-11401

Name of the Vulnerable Software and Affected Versions Rapid7 Insight Platform versions prior to November 13, 2024

Description The issue is a privilege escalation vulnerability due to a lack of authorization checks. An attacker can update the password policy in the platform settings as a standard user by manipulating an API. This functionality was not possible through the platform's User Interface.

Recommendations For versions prior to November 13, 2024, update to a version that includes the fix for this issue, as it has been corrected as of November 13, 2024. As a temporary workaround, consider restricting access to the API that allows password policy updates until a patch is applied.