{"affected":[{"affectedData":[{"product":"Insight Agent","vendor":"Rapid7","versions":[{"status":"affected","version":"2.6.3 and prior"}]}],"source":"cve@rapid7.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:rapid7:insight_agent:*:*:*:*:*:*:*:*","matchCriteriaId":"69F19D38-E9AE-46E3-878C-84EFB0D451A1","versionEndIncluding":"2.6.3","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Rapid7 Insight Agent, version 2.6.3 and prior, suffers from a local privilege escalation due to an uncontrolled DLL search path. Specifically, when Insight Agent 2.6.3 and prior starts, the Python interpreter attempts to load python3.dll at \"C:\\DLLs\\python3.dll,\" which normally is writable by locally authenticated users. Because of this, a malicious local user could use Insight Agent's startup conditions to elevate to SYSTEM privileges. This issue was fixed in Rapid7 Insight Agent 2.6.4."},{"lang":"es","value":"Insight Agent de Rapid7, versión 2.6.3 y anteriores, sufre de una escalada de privilegios locales debido a una ruta (path) de búsqueda de DLL no controlada. Específicamente, durante el inicio de Insight Agent versión 2.6.3 y anteriores, el intérprete de Python intenta cargar python3.dll en \"C:\\DLLs\\python3.dll\", que comúnmente es escribible por usuarios autenticados localmente. Debido a esto, un usuario local malicioso podría usar las condiciones de inicio de Insight Agent para elevar los privilegios a SYSTEM. Este problema fue solucionado en Rapid7 Insight Agent versión 2.6.4."}],"id":"CVE-2019-5629","lastModified":"2026-06-17T02:37:58.310","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"HIGH","cvssData":{"accessComplexity":"LOW","accessVector":"LOCAL","authentication":"NONE","availabilityImpact":"COMPLETE","baseScore":7.2,"confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","vectorString":"AV:L/AC:L/Au:N/C:C/I:C/A:C","version":"2.0"},"exploitabilityScore":3.9,"impactScore":10.0,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":false}],"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"cve@rapid7.com","type":"Secondary"}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2019-07-13T01:15:10.447","references":[{"source":"cve@rapid7.com","tags":["Third Party Advisory","VDB Entry"],"url":"http://packetstormsecurity.com/files/153159/Rapid7-Windows-InsightIDR-Agent-2.6.3.14-Local-Privilege-Escalation.html"},{"source":"cve@rapid7.com","tags":["Mailing List","Third Party Advisory"],"url":"http://seclists.org/fulldisclosure/2019/Jun/13"},{"source":"cve@rapid7.com","tags":["Exploit","Third Party Advisory"],"url":"https://bogner.sh/2019/06/local-privilege-escalation-in-rapid7s-windows-insight-idr-agent/"},{"source":"cve@rapid7.com","tags":["Third Party Advisory"],"url":"https://help.rapid7.com/insightagent/release-notes/archive/2019/05/#20190529"},{"source":"cve@rapid7.com","tags":["Issue Tracking","Mailing List","Third Party Advisory"],"url":"https://seclists.org/bugtraq/2019/Jun/0"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"url":"http://packetstormsecurity.com/files/153159/Rapid7-Windows-InsightIDR-Agent-2.6.3.14-Local-Privilege-Escalation.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"url":"http://seclists.org/fulldisclosure/2019/Jun/13"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"],"url":"https://bogner.sh/2019/06/local-privilege-escalation-in-rapid7s-windows-insight-idr-agent/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://help.rapid7.com/insightagent/release-notes/archive/2019/05/#20190529"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Mailing List","Third Party Advisory"],"url":"https://seclists.org/bugtraq/2019/Jun/0"}],"sourceIdentifier":"cve@rapid7.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-427"}],"source":"cve@rapid7.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-427"}],"source":"nvd@nist.gov","type":"Primary"}]}