title: Rapid7 InsightCloudSec resource.db() method access
description: An authenticated attacker can leverage an exposed resource.db() accessor method to smuggle Python method calls via a Jinja template, which can lead to code execution. This issue was resolved in the Managed and SaaS deployments on February 1, 2023, and in version 23.2.1 of the Self-Managed version of InsightCloudSec.
problem types: CWE-94 Improper Control of Generation of Code ('Code Injection')
affected:
{
defaultStatus: unaffected
product: InsightCloudSec
vendor: Rapid7
versions:
lessThanOrEqual: 23.2.0, status: affected, version: 0, versionType: semver
}