PT-2019-17797 · Rapid7 · Metasploit Pro

Publicado 2019-11-06 · Atualizado 2019-11-13 · CVE-2019-5642

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Baixa

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Rapid7 Metasploit Pro versions prior to 4.16.0-2019081901

Description The issue allows other users of the same system where Metasploit Pro is installed to intercept private communications to the Metasploit Pro web interface. This occurs because the unique server.key is written to the file system during installation with world-readable permissions.

Recommendations For Rapid7 Metasploit Pro versions prior to 4.16.0-2019081901, consider restricting access to the server.key file to prevent other users from reading it, until a newer version with proper permissions is available.

Correção

Incorrect Permission

Enumeração de Fraquezas

CWE-732

Identificadores relacionados

CVE-2019-5642

Produtos afetados

Metasploit Pro

Referências · 3

• https://help.rapid7.com/metasploit/release-notes/?rid=4.16.0-2019091001 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-5642 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-5642 · Nota de Segurança