PT-2023-16877 · Unknown · Insightcloudsec

Mike Alfaro · Publicado 2023-03-21 · Atualizado 2023-03-28 · CVE-2023-1305

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions InsightCloudSec versions prior to 23.2.1

Description An authenticated attacker can leverage an exposed “box” object to read and write arbitrary files from disk, provided those files can be parsed as yaml or JSON. This issue was resolved in the Managed and SaaS deployments on February 1, 2023.

Recommendations For versions prior to 23.2.1, update to version 23.2.1 to resolve the issue. As a temporary workaround, consider restricting access to the exposed “box” object until the update is applied.

Exploit

Correção

Enumeração de Fraquezas

CWE-653

Identificadores relacionados

CVE-2023-1305

Produtos afetados

Insightcloudsec

Referências · 6

• 🔥 https://nephosec.com/exploiting-rapid7s-insightcloudsec · Exploit
• https://docs.divvycloud.com/changelog/23321-release-notes · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-1305 · Nota de Segurança
• https://t.me/cibsecurity/60396 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-1305 · Aviso do Fabricante
• https://t.me/cvenotify/46565 · Publicação no Telegram