Vulnerability Description
Rapid7 Insight Agent token handler versions 3.2.6 and below, suffer from a Directory Traversal vulnerability whereby unsanitized input from a CLI argument flows into io.ioutil.WriteFile, where it is used as a path. This can result in a Path Traversal vulnerability and allow an attacker to write arbitrary files. This issue is remediated in version 3.3.0 via safe guards that reject inputs that attempt to do path traversal.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Rapid7 | Insight Agent | < 3.3.0 |
Related Weaknesses (CWE)
References
- https://docs.rapid7.com/release-notes/insightagent/20230425/Release Notes
- https://docs.rapid7.com/release-notes/insightagent/20230425/Release Notes
FAQ
What is CVE-2023-2273?
CVE-2023-2273 is a vulnerability with a CVSS score of 5.8 (MEDIUM). Rapid7 Insight Agent token handler versions 3.2.6 and below, suffer from a Directory Traversal vulnerability whereby unsanitized input from a CLI argument flows into io.ioutil.WriteFile, where it is u...
How severe is CVE-2023-2273?
CVE-2023-2273 has been rated MEDIUM with a CVSS base score of 5.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-2273?
Check the references section above for vendor advisories and patch information. Affected products include: Rapid7 Insight Agent.