CVE-2018-5559
In Rapid7 Komand version 0.41.0 and prior, certain endpoints that are able to list the always...
In Rapid7 Komand version 0.41.0 and prior, certain endpoints that are able to list the always encrypted-at-rest connection data could return some configurations of connection data without obscuring sensitive data from the API response sent over an encrypted channel. This issue does not affect Rapid7 Komand version 0.42.0 and later versions.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
In Rapid7 Komand version 0.41.0 and prior, certain endpoints that are able to list the always encrypted-at-rest connection data could return some configurations of connection data without obscuring sensitive data from the API response sent over an encrypted channel. This issue does not affect Rapid7 Komand version 0.42.0 and later versions.
- Record
CVE-2018-5559- CVSS 3.0
- 3.4 Low
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N - Weakness
- CWE-212
- Updated
- 2026-11-02
EUVDEUVD-2018-17328
In Rapid7 Komand version 0.41.0 and prior, certain endpoints that are able to list the always encrypted-at-rest connection data could return some configurations of connection data without obscuring sensitive data from the API response sent over an encrypted channel. This issue does not affect Rapid7 Komand version 0.42.0 and later versions.
- Record
EUVD-2018-17328- CVSS 3.0
- 3.4 Low
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5rgv-v326-94h6
In Rapid7 Komand version 0.41.0 and prior, certain endpoints that are able to list the always...
In Rapid7 Komand version 0.41.0 and prior, certain endpoints that are able to list the always encrypted-at-rest connection data could return some configurations of connection data without obscuring sensitive data from the API response sent over an encrypted channel. This issue does not affect Rapid7 Komand version 0.42.0 and later versions.
- Record
GHSA-5rgv-v326-94h6- CVSS 3.0
- 4.9 Medium
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-312
- Updated
- 2026-11-02
NVD
In Rapid7 Komand version 0.41.0 and prior, certain endpoints that are able to list the always encrypted-at-rest connection data could return some configurations of connection data without obscuring sensitive data from the API response sent over an encrypted channel. This issue does not affect Rapid7 Komand version 0.42.0 and later versions.
- Record
CVE-2018-5559- CVSS 3.0
- 3.4 Low
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N - CVSS 3.0
- 4.9 Medium
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Weakness
- CWE-212, CWE-312
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-5559 is a low vulnerability (CVSS 3.4) in Rapid7 Komand, published November 28, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.62%, the 50th percentile. No source names a fixed version.