{
  "schema_version": "1.4.0",
  "id": "GHSA-hwwf-273g-8x77",
  "modified": "2022-05-24T16:50:13Z",
  "published": "2022-05-24T16:50:13Z",
  "aliases": [
    "CVE-2019-5629"
  ],
  "details": "Rapid7 Insight Agent, version 2.6.3 and prior, suffers from a local privilege escalation due to an uncontrolled DLL search path. Specifically, when Insight Agent 2.6.3 and prior starts, the Python interpreter attempts to load python3.dll at \"C:\\DLLs\\python3.dll,\" which normally is writable by locally authenticated users. Because of this, a malicious local user could use Insight Agent's startup conditions to elevate to SYSTEM privileges. This issue was fixed in Rapid7 Insight Agent 2.6.4.",
  "severity": [],
  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5629"
    },
    {
      "type": "WEB",
      "url": "https://bogner.sh/2019/06/local-privilege-escalation-in-rapid7s-windows-insight-idr-agent"
    },
    {
      "type": "WEB",
      "url": "https://help.rapid7.com/insightagent/release-notes/archive/2019/05/#20190529"
    },
    {
      "type": "WEB",
      "url": "https://seclists.org/bugtraq/2019/Jun/0"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/153159/Rapid7-Windows-InsightIDR-Agent-2.6.3.14-Local-Privilege-Escalation.html"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2019/Jun/13"
    }
  ],
  "database_specific": {
    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-07-13T01:15:00Z"
  }
}