CVE-2023-2273CWE-22

Rapid7 Insight Agent Directory Traversal

Medium · published April 26, 2023

CVSS v3.1
5.8
EPSS
1%
Percentile
53.5
In the wild
Unconfirmed
What it is

Rapid7 Insight Agent token handler versions 3.2.6 and below, suffer from a Directory Traversal vulnerability whereby unsanitized input from a CLI argument flows into io.ioutil.WriteFile, where it is used as a path. This can result in a Path Traversal vulnerability and allow an attacker to write arbitrary files. This issue is remediated in version 3.3.0 via safe guards that reject inputs that attempt to do path traversal.

The record
Technical detail
CVSS v3.1
5.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00722 · 53.5th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2023-04-26T08:55Z
EPSS history
Timeline
  • 26 APR 08:55Z
    Rapid7 Insight Agent Directory Traversal
    cvelistv5