CVE-2019-5624

moderate-risk
Published 2019-04-30

Rapid7 Metasploit Framework suffers from an instance of CWE-22, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in the Zip import function of Metasploit. Exploiting this vulnerability can allow an attacker to execute arbitrary code in Metasploit at the privilege level of the user running Metasploit. This issue affects: Rapid7 Metasploit Framework version 4.14.0 and prior versions.

Do I need to act?

~
4.4% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.3/10 High
LOCAL / LOW complexity

Affected Products (1)

Affected Vendors

Rapid7

References (6)

Exploit https://blog.doyensec.com/2019/04/24/rubyzip-bug.html
Exploit https://github.com/rapid7/metasploit-framework/pull/11716
Release Notes https://help.rapid7.com/metasploit/release-notes/archive/2019/04/#20190416
Exploit https://blog.doyensec.com/2019/04/24/rubyzip-bug.html
Exploit https://github.com/rapid7/metasploit-framework/pull/11716
Release Notes https://help.rapid7.com/metasploit/release-notes/archive/2019/04/#20190416
36
/ 100
moderate-risk
Severity 23/34 · High
Exploitability 8/34 · Low
Exposure 5/34 · Minimal