Rapid7 Metasploit Framework suffers from an instance of CWE-22, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in the Zip import function of Metasploit. Exploiting this vulnerability can allow an attacker to execute arbitrary code in Metasploit at the privilege level of the user running Metasploit. This issue affects: Rapid7 Metasploit Framework version 4.14.0 and prior versions.
References
| Link | Resource |
|---|---|
| https://blog.doyensec.com/2019/04/24/rubyzip-bug.html | Exploit Third Party Advisory |
| https://github.com/rapid7/metasploit-framework/pull/11716 | Exploit Patch Third Party Advisory |
| https://help.rapid7.com/metasploit/release-notes/archive/2019/04/#20190416 | Release Notes Vendor Advisory |
| https://blog.doyensec.com/2019/04/24/rubyzip-bug.html | Exploit Third Party Advisory |
| https://github.com/rapid7/metasploit-framework/pull/11716 | Exploit Patch Third Party Advisory |
| https://help.rapid7.com/metasploit/release-notes/archive/2019/04/#20190416 | Release Notes Vendor Advisory |
Configurations
History
21 Nov 2024, 04:45
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://blog.doyensec.com/2019/04/24/rubyzip-bug.html - Exploit, Third Party Advisory | |
| References | () https://github.com/rapid7/metasploit-framework/pull/11716 - Exploit, Patch, Third Party Advisory | |
| References | () https://help.rapid7.com/metasploit/release-notes/archive/2019/04/#20190416 - Release Notes, Vendor Advisory |
Information
Published : 2019-04-30 17:29
Updated : 2024-11-21 04:45
NVD link : CVE-2019-5624
Mitre link : CVE-2019-5624
CVE.ORG link : CVE-2019-5624
JSON object : View
Products Affected
rapid7
- metasploit
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')