CVE-2019-5624
Rapid7 Metasploit Framework Zip Import Directory Traversal
- State
- Published
- Severity
- 7.4 High
- Published
- Apr 30, 2019
- Updated
- Sep 17, 2024
- Reserved
- Jan 7, 2019
Description
Rapid7 Metasploit Framework suffers from an instance of CWE-22, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in the Zip import function of Metasploit. Exploiting this vulnerability can allow an attacker to execute arbitrary code in Metasploit at the privilege level of the user running Metasploit. This issue affects: Rapid7 Metasploit Framework version 4.14.0 and prior versions.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 7.4 High | CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N | rapid7 |
Weaknesses
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Products
| Product | Versions |
|---|---|
Metasploit FrameworkRapid7 |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.