cve/2024/CVE-2024-11401.md

### [CVE-2024-11401](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-11401)
![](https://img.shields.io/static/v1?label=Product&message=Insight%20Platform&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=Before%20Novemeber%2013th%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-862%20Missing%20Authorization&color=brightgreen)

### Description

Rapid7 Insight Platform versions prior to November 13th 2024, suffer from a privilege escalation vulnerability whereby, due to a lack of authorization checks, an attacker can successfully update the password policy in the platform settings as a standard user by crafting an API (the functionality was not possible through the platform's User Interface). This vulnerability has been fixed as of November 13th 2024.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/fkie-cad/nvd-json-data-feeds