Rapid7 Insightappsec — known CVE vulnerabilities

Every CVE whose affected-product data names Rapid7 Insightappsec, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (4)

• CVE-2023-1304 — CVSS 8.8 (high): An authenticated attacker can leverage an exposed getattr() method via a Jinja template to smuggle OS commands and perform other actions…
• CVE-2023-1306 — CVSS 8.8 (high): An authenticated attacker can leverage an exposed resource.db() accessor method to smuggle Python method calls via a Jinja template, which…
• CVE-2023-1305 — CVSS 8.1 (high): An authenticated attacker can leverage an exposed “box” object to read and write arbitrary files from disk, provided those files can be…
• CVE-2019-5631 — CVSS 7.8 (high): The Rapid7 InsightAppSec broker suffers from a DLL injection vulnerability in the 'prunsrv.exe' component of the product. If exploited, a…