PT-2023-18671 · Rapid7 · Rapid7 Insight Agent
CVE-2023-2273
·
Published
2023-04-26
·
Updated
2023-05-04
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Rapid7 Insight Agent versions 3.2.6 and below
Description
The issue is related to a Directory Traversal vulnerability. Unsantized input from a CLI argument flows into
io.ioutil.WriteFile, where it is used as a path, potentially allowing an attacker to write arbitrary files.Recommendations
For versions 3.2.6 and below, update to version 3.3.0 to resolve the issue, as it includes safeguards that reject inputs attempting path traversal.
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Rapid7 Insight Agent