CVE-2020-7384

Rapid7's Metasploit msfvenom framework handles APK files in a way that allows for a malicious user to craft and publish a file that would execute arbitrary commands on a victim's machine.

Score

CVSS 3.1 7.8 High

Status

Modified - cve@rapid7.com

Published

2020-10-29

Last modified

2024-08-04

Weaknesses

CWE-77

Affected products

• Metasploit (Rapid7)

References

• http://packetstormsecurity.com/files/160004/Rapid7-Metasploit-Framework-msfvenom-APK-Template-Command-Injection.html
• http://packetstormsecurity.com/files/161200/Metasploit-Framework-6.0.11-Command-Injection.html
• https://github.com/rapid7/metasploit-framework/pull/14288