CVE-2023-1304CWE-94

Rapid7 InsightCloudSec getattr() method access

High · published March 21, 2023

CVSS v3.1
8.8
EPSS
1%
Percentile
64.8
In the wild
Unconfirmed
What it is

An authenticated attacker can leverage an exposed getattr() method via a Jinja template to smuggle OS commands and perform other actions that are normally expected to be private methods. This issue was resolved in the Managed and SaaS deployments on February 1, 2023, and in version 23.2.1 of the Self-Managed version of InsightCloudSec.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01079 · 64.8th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2023-03-21T16:45Z
EPSS history
Timeline
  • 21 MAR 16:45Z
    Rapid7 InsightCloudSec getattr() method access
    cvelistv5