CVE-2022-0237

Katalog CVE

CVSS 7.8 · High EPSS 0,48%

Kerentanan Permissions, Privileges, and Access Controls pada rapid7 insight agent. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

Rapid7 Insight Agent versions 3.1.2.38 and earlier suffer from a privilege escalation vulnerability, whereby an attacker can hijack the flow of execution due to an unquoted argument to the runas.exe command used by the ir_agent.exe component, resulting in elevated rights and persistent access to the machine. This issue was fixed in Rapid7 Insight Agent version 3.1.3.80.

Rincian

Terbit di NVD

17 Maret 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-264: Permissions, Privileges, and Access Controls
CWE-428: Unquoted Search Path or Element

EPSS (30 hari)

0,48% peluang dieksploitasi; lebih tinggi dari 39,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://docs.rapid7.com/release-notes/insightagent/20220225/ release notes · advisory vendor
• https://gist.github.com/n2dez/05d43c616f2b403e84ee55d4d7aab251 exploit · advisory pihak ketiga