CVE-2017-5231
All editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory traversal vulnerability in the Meterpreter stdapi CommandDispatcher.cmd_download() function. By using a specially-crafted build of Meterpreter, it is possible to write to an arbitrary directory on the Metasploit console with the permissions of the running Metasploit instance.
- Score
- CVSS 3.0 7.1 High
- Status
- Modified - cve@rapid7.com
- Published
- 2017-03-02
- Last modified
- 2024-08-05
- Weaknesses
- CWE-22
Affected products
References
- http://www.securityfocus.com/bid/96954
- https://community.rapid7.com/community/infosec/blog/2017/03/01/multiple-vulnerabilities-affecting-four-rapid7-products
