CVE-2023-36467

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

AWS data.all is an open source development framework to help users build a data marketplace on Amazon Web Services. data.all versions 1.2.0 through 1.5.1 do not prevent remote code execution when a user injects Python commands into the ‘Template’ field when configuring a data pipeline. The issue can only be triggered by authenticated users. A fix for this issue is available in data.all version 1.5.2 and later. There is no recommended work around.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Jun 28, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-364688.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When an XWiki installation is upgra CVE-2023-364698.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can edit their own use CVE-2023-36474.8The IURNY by INDIGITALL WordPress plugin before 3.2.3 does not sanitise and escape some of its settings, which could allow high privilege us CVE-2023-364708.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. By either creating a new or editing CVE-2023-364715.4Xwiki commons is the common modules used by other XWiki top level projects. The HTML sanitizer that is included in XWiki since version 14.6R CVE-2023-364725.7Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset pas CVE-2023-364736.1Discourse is an open source discussion platform. A CSP (Content Security Policy) nonce reuse vulnerability could allow XSS attacks to bypass CVE-2023-364746.1Interactsh is an open-source tool for detecting out-of-band interactions. Domains configured with interactsh server prior to version 1.0.0 w CVE-2023-364759.8Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 5.5.2 and 6.2.1, a CVE-2023-364765.5calamares-nixos-extensions provides Calamares branding and modules for NixOS, a distribution of GNU/Linux. Users of calamares-nixos-extensio CVE-2023-364775.4XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit rights can edit CVE-2023-364787.5Eclipse Jetty provides a web server and servlet container. In versions 11.0.0 through 11.0.15, 10.0.0 through 10.0.15, and 9.0.0 through 9.4