CVE-2021-4016 Rapid7 Insight Agent Improper Access Control
An attacker can read and copy sensitive files from the snapshot directory due to improper access controls in Rapid7 Insight Agent.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-4016?
CVE-2021-4016 is a medium-severity missing authorization vulnerability in Rapid7 Insight Agent, published on 21 Jan 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Rapid7 Insight Agent, versions prior to 3.1.3, suffer from an improper access control vulnerability whereby, the user has access to the snapshot directory. An attacker can access, read and copy any of the files in this directory e.g. asset_info.json or file_info.json, leading to a loss of confidentiality. This issue was fixed in Rapid7 Insight Agent 3.1.3.
Weakness: CWE-284
Which versions are affected by CVE-2021-4016?
It affects 1 product.
Products include Rapid7 Insight Agent.
How do I fix CVE-2021-4016?
No fix has been published for CVE-2021-4016 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-4016 being exploited?
There is no known exploitation of CVE-2021-4016 in the wild and no public exploit code.
Other vulnerabilities in Rapid7 Insight Agent
- CVE-2026-6482 Local Privilege Escalation via OpenSSL configuration file in Insight Agent
- CVE-2021-4007 Rapid7 Insight Agent Privilege Escalation
- CVE-2019-5629 Privilege escalation in Insight Agent
- CVE-2026-4482 Insight Agent Private Key Information Disclosure via Inherited File Permissions
- CVE-2026-4837 Eval Injection in Rapid7 Insight Agent
Sources
Also known as GHSA-hr69-m797-3q5c.