CVE-2019-5638
Rapid7 Nexpose Insufficient Session Management
- Published
- Updated
- Reserved
- Assigned by
- rapid7
Description
Rapid7 Nexpose versions 6.5.50 and prior suffer from insufficient session expiration when an administrator performs a security relevant edit on an existing, logged on user. For example, if a user's password is changed by an administrator due to an otherwise unrelated credential leak, that user account's current session is still valid after the password change, potentially allowing the attacker who originally compromised the credential to remain logged in and able to cause further damage.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| rapid7CNA (assigner) | 3.1 | High8.7 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N |
| NVDNVD · Modified | 3.1 | High8.7 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N |
- EPSS (exploitation in 30 days)
- 0.83% · top 42% of all CVEs (6 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.7.
Weakness
Affected products
What to do
Solution: This issue is resolved in versions 6.5.51 and later of Rapid7 Nexpose.
References (2)
- https://help.rapid7.com/nexpose/en-us/release-notes/archive/2019/02/ (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://docs.rapid7.com/insightvm/enable-insightvm-platform-login (opens in a new tab)vendor-advisoryx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2019-5638)Record last updated .