important · Privilege — Windows
Rapid7 assessment content could turn a writable Windows PATH entry into SYSTEM execution.
Affects
Rapid7 Insight Agent on Windows, an endpoint agent that runs centrally delivered InsightVM assessment content.
The attacker first needs a non-administrator-writable machine PATH directory ahead of Visual Studio Code. A planted executable named code is then selected by a SYSTEM assessment check.
Detail and 2 sources
Rapid7 says corrected assessment content was delivered automatically to all agents.