CVE-2019-5631

Rapid7 InsightAppSec Local Privilege Escalation

State: Published
Severity: 7.8 High
Published: Aug 19, 2019
Updated: Sep 16, 2024
Reserved: Jan 7, 2019

Description

The Rapid7 InsightAppSec broker suffers from a DLL injection vulnerability in the 'prunsrv.exe' component of the product. If exploited, a local user of the system (who must already be authenticated to the operating system) can elevate their privileges with this vulnerability to the privilege level of InsightAppSec (usually, SYSTEM). This issue affects version 2019.06.24 and prior versions of the product.

Scores

CVSS	Score	Vector	Source
3.0	7.8 High	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	rapid7

Weaknesses

CWE-427 Uncontrolled Search Path Element

Affected Products

Product	Versions
InsightAppSecRapid7	2019.06.24 through 2019.06.24Affected

References

https://help.rapid7.com/insightappsec/release-notes/archive/2019/07/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.