CVE-2019-5631

HIGH

Rapid7 InsightAppSec < 2019.06.24 - DLL Injection in prunsrv.exe

Title source: llm
STIX 2.1

Description

The Rapid7 InsightAppSec broker suffers from a DLL injection vulnerability in the 'prunsrv.exe' component of the product. If exploited, a local user of the system (who must already be authenticated to the operating system) can elevate their privileges with this vulnerability to the privilege level of InsightAppSec (usually, SYSTEM). This issue affects version 2019.06.24 and prior versions of the product.

References (1)

Core 1
Core References
Release Notes, Vendor Advisory x_refsource_confirm
https://help.rapid7.com/insightappsec/release-notes/archive/2019/07/

Scores

CVSS v3 7.8
EPSS 0.0106
EPSS Percentile 60.1%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-427 CWE-426
Status published
Products (1)
rapid7/insightappsec < 2019.06.24
Published Aug 19, 2019
Tracked Since Feb 18, 2026