CVEvulnerability

CVE-2019-5631

7.8 HIGH Published 2019-08-19 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-08-19
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.0 ([email protected])
7.8 HIGH — CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
9.3 HIGH — AV:N/AC:M/Au:N/C:C/I:C/A:C
Weaknesses
CWE-426, CWE-427

Description

The Rapid7 InsightAppSec broker suffers from a DLL injection vulnerability in the 'prunsrv.exe' component of the product. If exploited, a local user of the system (who must already be authenticated to the operating system) can elevate their privileges with this vulnerability to the privilege level of InsightAppSec (usually, SYSTEM). This issue affects version 2019.06.24 and prior versions of the product.

Affected configurations

• rapid7 insightappsec (<= 2019.06.24)

Related

Weakness · CWE (2)

  • CWE-426 Untrusted Search Path weakness
  • CWE-427 Uncontrolled Search Path Element weakness

References