Low severity · published Jan 21, 2022
CVE-2021-4016
Rapid7 Insight Agent, versions prior to 3.1.3, suffer from an improper access control vulnerability whereby, the user has access to the snapshot directory
3.3
CVSS
0.2%
EPSS
No
On KEV
Description
Rapid7 Insight Agent, versions prior to 3.1.3, suffer from an improper access control vulnerability whereby, the user has access to the snapshot directory. An attacker can access, read and copy any of the files in this directory e.g. asset_info.json or file_info.json, leading to a loss of confidentiality. This issue was fixed in Rapid7 Insight Agent 3.1.3.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IA
Insight Agent · Rapid7
before 3.1.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-4016
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-4016
Release Notes
https://docs.rapid7.com/release-notes/insightagent/20220119/
More from Insight Agent
7.8
CVE-2026-89325
Rapid7 Insight Agent: Uncontrolled search path element in InsightVM assessment content leads to local privilege escalation
7.8
CVE-2026-14172
Rapid7 InsightVM, Nexpose, and Insight Agent Local Privilege Escalation via Unvalidated Executable Invocation
7.8
CVE-2026-6482
Local Privilege Escalation via OpenSSL configuration file in Insight Agent
7.8
CVE-2022-0237
Rapid7 Insight Agent versions 3.1.2.38 and earlier suffer from a privilege escalation vulnerability, whereby an attacker can hijack the flow of execution due to an unquoted…
7.8
CVE-2021-4007
Rapid7 Insight Agent, versions 3.0.1 to 3.1.2.34, suffer from a local privilege escalation due to an uncontrolled DLL search path