1. Home
  2. CVE Database
  3. CVE-2019-5631
HIGH · 7.8

CVE-2019-5631

The Rapid7 InsightAppSec broker suffers from a DLL injection vulnerability in the 'prunsrv.exe' component of the product. If exploited, a local user of the system (who must already be authenticated to...

Vulnerability Description

The Rapid7 InsightAppSec broker suffers from a DLL injection vulnerability in the 'prunsrv.exe' component of the product. If exploited, a local user of the system (who must already be authenticated to the operating system) can elevate their privileges with this vulnerability to the privilege level of InsightAppSec (usually, SYSTEM). This issue affects version 2019.06.24 and prior versions of the product.

CVSS Score

7.8

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
Rapid7Insightappsec<= 2019.06.24

Related Weaknesses (CWE)

CWE-426CWE-427

References

FAQ

What is CVE-2019-5631?

CVE-2019-5631 is a vulnerability with a CVSS score of 7.8 (HIGH). The Rapid7 InsightAppSec broker suffers from a DLL injection vulnerability in the 'prunsrv.exe' component of the product. If exploited, a local user of the system (who must already be authenticated to...

How severe is CVE-2019-5631?

CVE-2019-5631 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2019-5631?

Check the references section above for vendor advisories and patch information. Affected products include: Rapid7 Insightappsec.