PT-2019-17789

CVE-2019-5629

Published

2019-07-13

Updated

2021-12-14

Description by

CVSS 3.1

7.8

High

MetricsAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rapid7 Insight Agent versions 2.6.3 and prior

Description The issue is related to an uncontrolled DLL search path, allowing a malicious local user to elevate to SYSTEM privileges. This occurs when the Python interpreter attempts to load python3.dll from a writable location, specifically "C:DLLspython3.dll".

Recommendations For Rapid7 Insight Agent versions 2.6.3 and prior, update to version 2.6.4 to resolve the issue.

Exploitability

Exploit

Fix

Impacts

Researchers

Florian Bogner

Vendors

Affected products

Weakness enumeration

CWE-427: Uncontrolled Search Path Element

Related identifiers