MAGICK
CVE-2019-5642

3.3LOW

Key Information:

Vendor

Rapid7

Status
Metasploit Pro
Vendor
CVE Published:
6 November 2019

What is CVE-2019-5642?

Rapid7 Metasploit Pro version 4.16.0-2019081901 and prior suffers from an instance of CWE-732, wherein the unique server.key is written to the file system during installation with world-readable permissions. This can allow other users of the same system where Metasploit Pro is installed to intercept otherwise private communications to the Metasploit Pro web interface.

Affected Version(s)

Metasploit Pro <= 4.16.0-2019081901

References

https://help.rapid7.com/metasploit/release-notes/?rid=4.1...
x_refsource_CONFIRM

CVSS V3.1

Score:
3.3
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This issue was discovered and reported to Rapid7 by Rodney Beele. It is being disclosed in accordance with Rapid7's vulnerability disclosure policy (https://www.rapid7.com/disclosure/).
.
CVE-2019-5642 : MAGICK