CVEvulnerability

CVE-2023-1304

8.8 HIGH Published 2023-03-21 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-03-21
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94

Description

An authenticated attacker can leverage an exposed getattr() method via a Jinja template to smuggle OS commands and perform other actions that are normally expected to be private methods. This issue was resolved in the Managed and SaaS deployments on February 1, 2023, and in version 23.2.1 of the Self-Managed version of InsightCloudSec.

Affected configurations

• rapid7 insightappsec (< 23.2.1) • rapid7 insightcloudsec (< 2023.02.01)

Related

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References