CVE-2023-36467: AWS data.all vulnerable to RCE through user injection of Python Commands
First published: Wed Jun 28 2023(Updated: )
AWS data.all is an open source development framework to help users build a data marketplace on Amazon Web Services. data.all versions 1.2.0 through 1.5.1 do not prevent remote code execution when a user injects Python commands into the ‘Template’ field when configuring a data pipeline. The issue can only be triggered by authenticated users. A fix for this issue is available in data.all version 1.5.2 and later. There is no recommended work around.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Amazon Aws-dataall | >=1.2.0<=1.5.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for AWS data.all?
The vulnerability ID for AWS data.all is CVE-2023-36467.
What is AWS data.all?
AWS data.all is an open source development framework to help users build a data marketplace on Amazon Web Services.
What is the severity of CVE-2023-36467?
The severity of CVE-2023-36467 is high with a severity value of 8.8.
How does the vulnerability in AWS data.all occur?
The vulnerability in AWS data.all occurs when a user injects Python commands into the 'Template' field when configuring a data pipeline.
How can I fix CVE-2023-36467?
To fix CVE-2023-36467, update data.all to version 1.5.2 or 1.5.4.
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/remedy
- agent/title
- agent/last-modified-date
- agent/weakness
- agent/tags
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- vendor/amazon
- canonical/amazon aws-dataall
- version/amazon aws-dataall/1.2.0
- version/amazon aws-dataall/1.5.1