Rapid7 Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/rapid7/ Sun, 26 Feb 2023 06:50:23 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png Rapid7 Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/rapid7/ 32 32 CVE-2018-5559 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-5559/ Sun, 26 Feb 2023 06:50:23 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-5559/ In Rapid7 Komand version 0.41.0 and prior, certain endpoints that are able to list the always encrypted-at-rest connection data could return some configurations of connection data without obscuring sensitive data from the API response sent over an encrypted channel. This issue does not affect Rapid7 Komand version 0.42.0 and later versions.

The post CVE-2018-5559 appeared first on CVE Vulnerability.

]]> In Rapid7 Komand version 0.41.0 and prior, certain endpoints that are able to list the always encrypted-at-rest connection data could return some configurations of connection data without obscuring sensitive data from the API response sent over an encrypted channel. This issue does not affect Rapid7 Komand version 0.42.0 and later versions.

The post CVE-2018-5559 appeared first on CVE Vulnerability.

]]> CVE-2020-7385 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-7385/ Sun, 26 Feb 2023 06:43:03 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-7385/ By launching the drb_remote_codeexec exploit, a Metasploit Framework user will inadvertently expose Metasploit to the same deserialization issue that is exploited by that module, due to the reliance on the vulnerable Distributed Ruby class functions. Since Metasploit Framework typically runs with elevated privileges, this can lead to a system compromise on the Metasploit workstation. Note […]

The post CVE-2020-7385 appeared first on CVE Vulnerability.

]]> By launching the drb_remote_codeexec exploit, a Metasploit Framework user will inadvertently expose Metasploit to the same deserialization issue that is exploited by that module, due to the reliance on the vulnerable Distributed Ruby class functions. Since Metasploit Framework typically runs with elevated privileges, this can lead to a system compromise on the Metasploit workstation. Note that an attacker would have to lie in wait and entice the Metasploit user to run the affected module against a malicious endpoint in a “hack-back” type of attack. Metasploit is only vulnerable when the drb_remote_codeexec module is running. In most cases, this cannot happen automatically.

The post CVE-2020-7385 appeared first on CVE Vulnerability.

]]> CVE-2020-7384 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-7384/ Sun, 26 Feb 2023 06:43:03 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-7384/ Rapid7’s Metasploit msfvenom framework handles APK files in a way that allows for a malicious user to craft and publish a file that would execute arbitrary commands on a victim’s machine.

The post CVE-2020-7384 appeared first on CVE Vulnerability.

]]> Rapid7’s Metasploit msfvenom framework handles APK files in a way that allows for a malicious user to craft and publish a file that would execute arbitrary commands on a victim’s machine.

The post CVE-2020-7384 appeared first on CVE Vulnerability.

]]> CVE-2020-7383 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-7383/ Sun, 26 Feb 2023 06:43:03 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-7383/ A SQL Injection issue in Rapid7 Nexpose version prior to 6.6.49 that may have allowed an authenticated user with a low permission level to access resources & make changes they should not have been able to access.

The post CVE-2020-7383 appeared first on CVE Vulnerability.

]]> A SQL Injection issue in Rapid7 Nexpose version prior to 6.6.49 that may have allowed an authenticated user with a low permission level to access resources & make changes they should not have been able to access.

The post CVE-2020-7383 appeared first on CVE Vulnerability.

]]> CVE-2020-7382 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-7382/ Sun, 26 Feb 2023 06:43:03 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-7382/ Rapid7 Nexpose installer version prior to 6.6.40 contains an Unquoted Search Path which may allow an attacker on the local machine to insert an arbitrary file into the executable path. This issue affects: Rapid7 Nexpose versions prior to 6.6.40.

The post CVE-2020-7382 appeared first on CVE Vulnerability.

]]> Rapid7 Nexpose installer version prior to 6.6.40 contains an Unquoted Search Path which may allow an attacker on the local machine to insert an arbitrary file into the executable path. This issue affects: Rapid7 Nexpose versions prior to 6.6.40.

The post CVE-2020-7382 appeared first on CVE Vulnerability.

]]> CVE-2020-7381 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-7381/ Sun, 26 Feb 2023 06:43:03 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-7381/ In Rapid7 Nexpose installer versions prior to 6.6.40, the Nexpose installer calls an executable which can be placed in the appropriate directory by an attacker with access to the local machine. This would prevent the installer from distinguishing between a valid executable called during a Security Console installation and any arbitrary code executable using the […]

The post CVE-2020-7381 appeared first on CVE Vulnerability.

]]> In Rapid7 Nexpose installer versions prior to 6.6.40, the Nexpose installer calls an executable which can be placed in the appropriate directory by an attacker with access to the local machine. This would prevent the installer from distinguishing between a valid executable called during a Security Console installation and any arbitrary code executable using the same file name.

The post CVE-2020-7381 appeared first on CVE Vulnerability.

]]> CVE-2020-7377 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-7377/ Sun, 26 Feb 2023 06:43:03 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-7377/ The Metasploit Framework module “auxiliary/admin/http/telpho10_credential_dump” module is affected by a relative path traversal vulnerability in the untar method which can be exploited to write arbitrary files to arbitrary locations on the host file system when the module is run on a malicious HTTP server.

The post CVE-2020-7377 appeared first on CVE Vulnerability.

]]> The Metasploit Framework module “auxiliary/admin/http/telpho10_credential_dump” module is affected by a relative path traversal vulnerability in the untar method which can be exploited to write arbitrary files to arbitrary locations on the host file system when the module is run on a malicious HTTP server.

The post CVE-2020-7377 appeared first on CVE Vulnerability.

]]> CVE-2020-7376 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-7376/ Sun, 26 Feb 2023 06:43:03 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-7376/ The Metasploit Framework module “post/osx/gather/enum_osx module” is affected by a relative path traversal vulnerability in the get_keychains method which can be exploited to write arbitrary files to arbitrary locations on the host filesystem when the module is run on a malicious host.

The post CVE-2020-7376 appeared first on CVE Vulnerability.

]]> The Metasploit Framework module “post/osx/gather/enum_osx module” is affected by a relative path traversal vulnerability in the get_keychains method which can be exploited to write arbitrary files to arbitrary locations on the host filesystem when the module is run on a malicious host.

The post CVE-2020-7376 appeared first on CVE Vulnerability.

]]> CVE-2020-7355 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-7355/ Sun, 26 Feb 2023 06:43:02 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-7355/ Cross-site Scripting (XSS) vulnerability in the ‘notes’ field of a discovered scan asset in Rapid7 Metasploit Pro allows an attacker with a specially-crafted network service of a scan target store an XSS sequence in the Metasploit Pro console, which will trigger when the operator views the record of that scanned host in the Metasploit Pro […]

The post CVE-2020-7355 appeared first on CVE Vulnerability.

]]> Cross-site Scripting (XSS) vulnerability in the ‘notes’ field of a discovered scan asset in Rapid7 Metasploit Pro allows an attacker with a specially-crafted network service of a scan target store an XSS sequence in the Metasploit Pro console, which will trigger when the operator views the record of that scanned host in the Metasploit Pro interface. This issue affects Rapid7 Metasploit Pro version 4.17.1-20200427 and prior versions, and is fixed in Metasploit Pro version 4.17.1-20200514. See also CVE-2020-7354, which describes a similar issue, but involving the generated ‘host’ field of a discovered scan asset.

The post CVE-2020-7355 appeared first on CVE Vulnerability.

]]> CVE-2020-7350 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-7350/ Sun, 26 Feb 2023 06:43:02 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-7350/ Rapid7 Metasploit Framework versions before 5.0.85 suffers from an instance of CWE-78: OS Command Injection, wherein the libnotify plugin accepts untrusted user-supplied data via a remote computer’s hostname or service name. An attacker can create a specially-crafted hostname or service name to be imported by Metasploit from a variety of sources and trigger a command […]

The post CVE-2020-7350 appeared first on CVE Vulnerability.

]]> Rapid7 Metasploit Framework versions before 5.0.85 suffers from an instance of CWE-78: OS Command Injection, wherein the libnotify plugin accepts untrusted user-supplied data via a remote computer’s hostname or service name. An attacker can create a specially-crafted hostname or service name to be imported by Metasploit from a variety of sources and trigger a command injection on the operator’s terminal. Note, only the Metasploit Framework and products that expose the plugin system is susceptible to this issue — notably, this does not include Rapid7 Metasploit Pro. Also note, this vulnerability cannot be triggered through a normal scan operation — the attacker would have to supply a file that is processed with the db_import command.

The post CVE-2020-7350 appeared first on CVE Vulnerability.

]]>