CVE-2023-42658CWE-917CWE-94

InSpec Archive Command Vulnerable to Maliciously Crafted Profile

High · published October 31, 2023

CVSS v3.1
8.8
EPSS
0%
Percentile
19.7
In the wild
Unconfirmed
What it is

Archive command in Chef InSpec prior to 4.56.58 and 5.22.29 allow local command execution via maliciously crafted profile.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00283 · 19.7th percentile
Weaknesses
CWE-917 · Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection'); CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2023-10-31T14:08Z
EPSS history
Timeline
  • 31 OCT 14:08Z
    InSpec Archive Command Vulnerable to Maliciously Crafted Profile
    cvelistv5