CVE-2023-36467

Katalog CVE

CVSS 8.8 · High EPSS 1,2%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada amazon aws-dataall. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

AWS data.all is an open source development framework to help users build a data marketplace on Amazon Web Services. data.all versions 1.2.0 through 1.5.1 do not prevent remote code execution when a user injects Python commands into the ‘Template’ field when configuring a data pipeline. The issue can only be triggered by authenticated users. A fix for this issue is available in data.all version 1.5.2 and later. There is no recommended work around.

Rincian

Terbit di NVD

28 Juni 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 66,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/awslabs/aws-dataall/security/advisories/GHSA-m922-chh7-8qcr advisory vendor
• https://github.com/awslabs/aws-dataall/pull/472 patch
• https://github.com/awslabs/aws-dataall/releases/tag/v1.5.2 release notes
• https://github.com/awslabs/aws-dataall/releases/tag/v1.5.4 release notes