Rapid7 Insightappsec
4 CVEs affecting Rapid7 Insightappsec. Latest disclosed: 2023-03-21. Critical: 0, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-1306 | High | 8.8 | 2023-03-21 | An authenticated attacker can leverage an exposed resource.db() accessor method to smuggle Python method calls via a Jinja template, which can lead to code exe… |
CVE-2023-1304 | High | 8.8 | 2023-03-21 | An authenticated attacker can leverage an exposed getattr() method via a Jinja template to smuggle OS commands and perform other actions that are normally expe… |
CVE-2023-1305 | High | 8.1 | 2023-03-21 | An authenticated attacker can leverage an exposed “box” object to read and write arbitrary files from disk, provided those files can be parsed as yaml or JSON… |
CVE-2019-5631 | High | 7.8 | 2019-08-19 | The Rapid7 InsightAppSec broker suffers from a DLL injection vulnerability in the 'prunsrv.exe' component of the product. If exploited, a local user of the sys… |