HIGH🇬🇧 English

CVE-2023-1305

CVSS 8.1v3.1pub. 2023-03-21upd. 2025-02-26

An authenticated attacker can leverage an exposed “box” object to read and write arbitrary files from disk, provided those files can be parsed as yaml or JSON. This issue was resolved in the Managed and SaaS deployments on February 1, 2023, and in version 23.2.1 of the Self-Managed version of InsightCloudSec.

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

  • Rapid7 Insightappsec

    APP
    Rapid7
    < 23.2.1

  • Rapid7 Insightcloudsec

    APP
    Rapid7
    < 2023.02.01
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
CWE
Referencje

Powiązane podatności

CVE-2023-1304HIGH8.8ten sam produkt

An authenticated attacker can leverage an exposed getattr() method via a Jinja template to smuggle OS commands...

CVE-2023-1306HIGH8.8ten sam produkt

An authenticated attacker can leverage an exposed resource.db() accessor method to smuggle Python method calls...

CVE-2019-5631HIGH7.8ten sam produkt

The Rapid7 InsightAppSec broker suffers from a DLL injection vulnerability in the 'prunsrv.exe' component of t...

CVE-2026-8592HIGH7.7ten sam vendor

OS Command Injection vulnerability in the process_string action of Rapid7 InsightConnect AWK Plugin on Linux a...

CVE-2026-8660HIGH7.7ten sam vendor

OS Command Injection vulnerability in the ping action of Rapid7 InsightConnect Ping Plugin on Linux allows rem...