CVE-2018-5559 - CVE House
Back to Database
Status published Low CVE-2018-5559

In Rapid7 Komand version 0.41.0 and prior, certain endpoints that...

Vulnerability Description

In Rapid7 Komand version 0.41.0 and prior, certain endpoints that are able to list the always encrypted-at-rest connection data could return some configurations of connection data without obscuring sensitive data from the API response sent over an encrypted channel. This issue does not affect Rapid7 Komand version 0.42.0 and later versions.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-5559

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Alexander Jäger, https://twitter.com/alexanderjaeger

References

More from Rapid7

View All →
CVE-2025-6264
Velociraptor priviledge escalation via UpdateConfig artifact
Medium 5.5
CVE-2025-4951
Editions of Rapid7 AppSpider Pro before version 7.5.018 is vulnerable to...
Medium 4.6
CVE-2025-36857
Rapid7 Appspider Broken Access Control Vulnerability
Low 3.3
CVE-2025-14728
Rapid7 Velociraptor Directory Traversal Vulnerability
Medium 6.8
CVE-2025-11195
Rapid7 AppSpider Project Name Validation Bypass
Low 3.3

Affected Vendor

Affected Software

Komand
Vulnerable Versions:
0.41.0, 0.42.0

Timeline

Official Publish: November 28th, 2018
Last Modified: September 17th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N

Weaknesses (CWE)

CWE-212

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.