CVE-2023-36467CWE-94

AWS data.all vulnerable to RCE through user injection of Python Commands

High · published June 28, 2023

CVSS v3.1
8.0
EPSS
1%
Percentile
67.4
In the wild
Unconfirmed
What it is

AWS data.all is an open source development framework to help users build a data marketplace on Amazon Web Services. data.all versions 1.2.0 through 1.5.1 do not prevent remote code execution when a user injects Python commands into the ‘Template’ field when configuring a data pipeline. The issue can only be triggered by authenticated users. A fix for this issue is available in data.all version 1.5.2 and later. There is no recommended work around.

The record
Technical detail
CVSS v3.1
8.0 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01180 · 67.4th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2023-06-28T13:55Z
EPSS history
Timeline
  • 28 JUN 13:55Z
    AWS data.all vulnerable to RCE through user injection of Python Commands
    cvelistv5