CVE-2023-1305

8.1 highEPSS 0.8%

High (8.1) in rapid7. EPSS 0.8% chance of exploitation in the next 30 days.

An authenticated attacker can leverage an exposed “box” object to read and write arbitrary files from disk, provided those files can be parsed as yaml or JSON. This issue was resolved in the Managed and SaaS deployments on February 1, 2023, and in version 23.2.1 of the Self-Managed version of InsightCloudSec.

Severity

CVSS 3.1

8.1 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 55% of CVEs (scores of 2026-10-31)
CWE: CWE-653
Published: 2023-03-21
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

rapid7:insightappsec
rapid7:insightcloudsec

References

https://docs.divvycloud.com/changelog/23321-release-notes
https://nephosec.com/exploiting-rapid7s-insightcloudsec/
https://docs.divvycloud.com/changelog/23321-release-notes
https://nephosec.com/exploiting-rapid7s-insightcloudsec/

Check your stack JSON