Rapid7 Insightcloudsec
3 CVEs affecting Rapid7 Insightcloudsec. Latest disclosed: 2023-03-21. Critical: 0, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-1306 | High | 8.8 | 2023-03-21 | An authenticated attacker can leverage an exposed resource.db() accessor method to smuggle Python method calls via a Jinja template, which can lead to code exe… |
CVE-2023-1304 | High | 8.8 | 2023-03-21 | An authenticated attacker can leverage an exposed getattr() method via a Jinja template to smuggle OS commands and perform other actions that are normally expe… |
CVE-2023-1305 | High | 8.1 | 2023-03-21 | An authenticated attacker can leverage an exposed “box” object to read and write arbitrary files from disk, provided those files can be parsed as yaml or JSON… |