PT-2019-17797 · Rapid7 · Metasploit Pro

Published 2019-11-06 · Updated 2019-11-13 · CVE-2019-5642

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Rapid7 Metasploit Pro versions prior to 4.16.0-2019081901

Description The issue allows other users of the same system where Metasploit Pro is installed to intercept private communications to the Metasploit Pro web interface. This occurs because the unique server.key is written to the file system during installation with world-readable permissions.

Recommendations For Rapid7 Metasploit Pro versions prior to 4.16.0-2019081901, consider restricting access to the server.key file to prevent other users from reading it, until a newer version with proper permissions is available.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2019-5642

Affected Products

Metasploit Pro

References · 3

• https://help.rapid7.com/metasploit/release-notes/?rid=4.16.0-2019091001 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-5642 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-5642 · Security Note