PT-2017-16409 · Rapid7 · Rapid7 Insight Collector

Publicado 2017-03-02 · Atualizado 2017-03-07 · CVE-2017-5234

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rapid7 Insight Collector versions prior to 1.0.16

Description The issue concerns a DLL preloading vulnerability. This means it is possible for the installer to load a malicious DLL located in the current working directory of the installer.

Recommendations For versions prior to 1.0.16, update to version 1.0.16 or later to resolve the issue.

Correção

Untrusted Search Path

Enumeração de Fraquezas

CWE-426

Identificadores relacionados

CVE-2017-5234

Produtos afetados

Rapid7 Insight Collector

Referências · 4

• http://securityfocus.com/bid/96545 · Nota
• https://community.rapid7.com/community/infosec/blog/2017/03/01/multiple-vulnerabilities-affecting-four-rapid7-products · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-5234 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-5234 · Nota de Segurança