vulnerability
Rapid7 Insight Agent: CVE-2023-2273: Directory Traversal vulnerability
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 8 | (AV:N/AC:L/Au:N/C:N/I:C/A:N) | Apr 26, 2023 | May 15, 2023 | Apr 23, 2024 |
Severity
8
CVSS
(AV:N/AC:L/Au:N/C:N/I:C/A:N)
Published
Apr 26, 2023
Added
May 15, 2023
Modified
Apr 23, 2024
Description
Rapid7 Insight Agent token handler versions 3.2.6 and below on Linux and Mac Operating Systems, suffer from a Directory Traversal vulnerability whereby unsanitized input from a CLI argument flows into io.ioutil.WriteFile, where it is used as a path. This can result in a Path Traversal vulnerability and allow an attacker to write arbitrary files. This issue is remediated in version 3.3.0 via safe guards that reject inputs that attempt to do path traversal.
Solution
rapid7-insightagent-cve-2023-2273
Rapid7 Labs
2026 Global Threat Landscape Report
The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.