CVE-2019-5624: Rapid7 Metasploit Framework Zip Import Directory Traversal
Rapid7 Metasploit Framework suffers from an instance of CWE-22, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in the Zip import function of Metasploit. Exploiting this vulnerability can allow an attacker to execute arbitrary code in Metasploit at the privilege level of the user running Metasploit. This issue affects: Rapid7 Metasploit Framework version 4.14.0 and prior versions.
Affected Software
Remediation
Patch Available
Information
Event History
Frequently Asked Questions
What is CVE-2019-5624?
CVE-2019-5624 refers to a vulnerability in Rapid7 Metasploit Framework that allows Path Traversal, enabling an attacker to execute arbitrary code in Metasploit at a high privilege level.
How severe is CVE-2019-5624?
CVE-2019-5624 has a severity rating of 7.3, which is considered high.
What is CWE-22?
CWE-22 is a classification for the vulnerability type 'Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)'.
Which software is affected by CVE-2019-5624?
Rapid7 Metasploit Framework versions up to and including 4.14.0 are affected by CVE-2019-5624.
How can an attacker exploit CVE-2019-5624?
An attacker can exploit CVE-2019-5624 by leveraging Path Traversal to manipulate file paths, allowing for the execution of arbitrary code in Metasploit.