CVE-2019-5631CWE-427

Rapid7 InsightAppSec Local Privilege Escalation

High · published August 19, 2019

CVSS v3.0
7.8
EPSS
1%
Percentile
64.3
In the wild
Unconfirmed
What it is

The Rapid7 InsightAppSec broker suffers from a DLL injection vulnerability in the 'prunsrv.exe' component of the product. If exploited, a local user of the system (who must already be authenticated to the operating system) can elevate their privileges with this vulnerability to the privilege level of InsightAppSec (usually, SYSTEM). This issue affects version 2019.06.24 and prior versions of the product.

The record
Technical detail
CVSS v3.0
7.8 · HIGH
Vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01060 · 64.3th percentile
Weakness
CWE-427 · Uncontrolled Search Path Element
Published
2019-08-19T14:32Z
EPSS history
Timeline
  • 19 AUG 14:32Z
    Rapid7 InsightAppSec Local Privilege Escalation
    cvelistv5