PT-2019-17789

CVE-2019-5629

Publicado

2019-07-13

Atualizado

2021-12-14

Descrição por

CVSS 3.1

7.8

Alta

MétricasAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rapid7 Insight Agent versions 2.6.3 and prior

Description The issue is related to an uncontrolled DLL search path, allowing a malicious local user to elevate to SYSTEM privileges. This occurs when the Python interpreter attempts to load python3.dll from a writable location, specifically "C:DLLspython3.dll".

Recommendations For Rapid7 Insight Agent versions 2.6.3 and prior, update to version 2.6.4 to resolve the issue.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Florian Bogner

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-427: Uncontrolled Search Path Element

Identificadores relacionados