CVE-2023-2273

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Rapid7 Insight Agent token handler versions 3.2.6 and below, suffer from a Directory Traversal vulnerability whereby unsanitized input from a CLI argument flows into io.ioutil.WriteFile, where it is used as a path. This can result in a Path Traversal vulnerability and allow an attacker to write arbitrary files. This issue is remediated in version 3.3.0 via safe guards that reject inputs that attempt to do path traversal.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Apr 26, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-227307.5Shopware is an open source commerce platform based on Symfony Framework and Vue js. In affected versions It was possible to put the same lin CVE-2023-227318.8Shopware is an open source commerce platform based on Symfony Framework and Vue js. In a Twig environment **without the Sandbox extension**,CVE-2023-227329.8Shopware is an open source commerce platform based on Symfony Framework and Vue js. The Administration session expiration was set to one wee CVE-2023-227336.5Shopware is an open source commerce platform based on Symfony Framework and Vue js. In affected versions the log module would write out all CVE-2023-227347.5Shopware is an open source commerce platform based on Symfony Framework and Vue js. The newsletter double opt-in validation was not checked CVE-2023-227354.6Zulip is an open-source team collaboration tool. In versions of zulip prior to commit `2f6c5a8` but after commit `04cf68b` users could uploa CVE-2023-227368.5Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions starting with 2.5.0-rc1 and above, prior to 2.5.8, and ve CVE-2023-227376.5wire-server provides back end services for Wire, a team communication and collaboration platform. Prior to version 2022-12-09, every member CVE-2023-227386.5vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Assigning existing users to a different orga CVE-2023-227396.5Discourse is an open source platform for community discussion. Versions prior to 3.0.1 (stable), 3.1.0.beta2 (beta), and 3.1.0.beta2 (tests-CVE-2023-227406.5Discourse is an open source platform for community discussion. Versions prior to 3.1.0.beta1 (beta) (tests-passed) are vulnerable to Alloca CVE-2023-227419.8Sofia-SIP is an open-source SIP User-Agent library, compliant with the IETF RFC3261 specification. In affected versions Sofia-SIP **lacks bo