CVE-2023-2273— Rapid7 Insight Agent Directory Traversal
Quick assessment
Affected
Rapid7 Insight Agent
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Rapid7 Insight Agent是美国Rapid7公司的一款轻量级软件。该软件能够从IT资产中收集数据。 Rapid7 Insight Agent 3.2.6版本及之前版本存在安全漏洞。攻击者利用该漏洞可以写入任意文件。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-2273
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Rapid7 Insight Agent Directory Traversal
Source: CVE Program / CVE List V5
Vulnerability Description
Rapid7 Insight Agent token handler versions 3.2.6 and below, suffer from a Directory Traversal vulnerability whereby unsanitized input from a CLI argument flows into io.ioutil.WriteFile, where it is used as a path. This can result in a Path Traversal vulnerability and allow an attacker to write arbitrary files. This issue is remediated in version 3.3.0 via safe guards that reject inputs that attempt to do path traversal.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Vulnerability Title
Rapid7 Insight Agent 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Rapid7 Insight Agent是美国Rapid7公司的一款轻量级软件。该软件能够从IT资产中收集数据。 Rapid7 Insight Agent 3.2.6版本及之前版本存在安全漏洞。攻击者利用该漏洞可以写入任意文件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Rapid7 | Insight Agent | 0 ~ 3.3.0 | - |
|
II. Public POCs for CVE-2023-2273
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-2273
请登录查看更多情报信息。
Other References for CVE-2023-2273 (1)
IV. Related Vulnerabilities
Same product: Insight Agent
-
CVE-2026-6482
Local Privilege Escalation via OpenSSL configuration file in -
CVE-2026-4482
Insight Agent Private Key Information Disclosure via Inherit -
CVE-2026-4837
Eval Injection in Rapid7 Insight Agent -
CVE-2024-3185
Rapid7 Insight Agent Sensitive Key Exposed To Local Users -
CVE-2022-0237
Rapid7 Insight Agent Privilege Escalation
Same vendor: Rapid7
-
CVE-2026-19200
Velociraptor Analyst overwrites live built-in artifacts thro -
CVE-2026-15371
Velociraptor Stored XSS in URL column types -
CVE-2026-18652
Velociraptor STACK Type Download Path Bypasses Denied Prefix -
CVE-2026-64951
Velociraptor DoS triggered by Divide by Zero panic -
CVE-2026-64952
Velociraptor Hunt Deletion With Insufficient Permission Chec
Same weakness: CWE-22
-
CVE-2026-71932
DrayTek VigorSwitch Multiple Models Path Traversal via getSy -
CVE-2026-77914
rConfig < 8.2.13 Core Path Traversal via Export Download End -
CVE-2026-71364
Awx: project archive extraction allows path traversal file w -
CVE-2026-78381
RansomLook Arbitrary File Read via Path Traversal in Post sc -
CVE-2026-76844
webpack-dev-middleware Path Traversal via Offset Slice on a
V. Comments for CVE-2023-2273
No comments yet