CVE-2023-1304

Katalog CVE

CVSS 8.8 · High EPSS 1,1%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada rapid7 insightappsec, rapid7 insightcloudsec. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

An authenticated attacker can leverage an exposed getattr() method via a Jinja template to smuggle OS commands and perform other actions that are normally expected to be private methods. This issue was resolved in the Managed and SaaS deployments on February 1, 2023, and in version 23.2.1 of the Self-Managed version of InsightCloudSec.

Rincian

Terbit di NVD

21 Maret 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 64,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://nephosec.com/exploiting-rapid7s-insightcloudsec/ exploit · advisory pihak ketiga
• https://docs.divvycloud.com/changelog/23321-release-notes release notes