Vulnerability · Published Oct 31, 2023 · Assigned by ProgressSoftware
CVE-2023-42658InSpec Archive Command Vulnerable to Maliciously Crafted Profile
High 8.8
In plain English
A high-severity code injection in Chef InSpec from Progress Software Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.3%top 77.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Archive command in Chef InSpec prior to 4.56.58 and 5.22.29 allow local command execution via maliciously crafted profile.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Progress Software Corporation | Chef InSpec | 4.0.0 – before 4.56.58 5.0.0 – before 5.22.29 |
Weakness: CWE-94, CWE-917 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H