CVE-2023-0599: Rapid7 Metasploit Pro Stored XSS
Rapid7 Metasploit Pro versions 4.21.2 and lower suffer from a stored cross site scripting vulnerability, due to a lack of JavaScript request string sanitization. Using this vulnerability, an authenticated attacker can execute arbitrary HTML and script code in the target browser against another Metasploit Pro user using a specially crafted request. Note that in most deployments, all Metasploit Pro users tend to enjoy privileges equivalent to local administrator.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-0599?
CVE-2023-0599 is classified as a stored cross site scripting vulnerability with a critical severity level.
How do I fix CVE-2023-0599?
To fix CVE-2023-0599, update Rapid7 Metasploit Pro to version 4.21.3 or later.
Who is affected by CVE-2023-0599?
CVE-2023-0599 affects users of Rapid7 Metasploit Pro versions 4.21.2 and lower.
What type of vulnerability is CVE-2023-0599?
CVE-2023-0599 is a stored cross site scripting vulnerability due to inadequate JavaScript request string sanitization.
What can attackers do with CVE-2023-0599?
Attackers can execute arbitrary HTML and script code in the target browser by exploiting CVE-2023-0599.