Metasploit Framework vulnerabilities
3 known vulnerabilities in Metasploit Framework from Rapid7. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.3 High severity
Metasploit Framework: Missing Authentication for Critical Functionality
The Rapid7 Metasploit msf-ws suffers from a missing authentication vulnerability whereby the REST API grants an unauthenticated "bootstrap" exemption so that the very first administrator can be created when the users table is empty. While the table is empty, P
- 9.8 Critical severity
Metasploit Framework: Missing Authentication for Critical Functionality
The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet. Every mutating and read route in this servlet calls warden.authenticate! before processing a request, except the update_credential
- 8.8 High severity
Metasploit Framework: Improper Limitation of a Pathname to a Restricted Directory
The Metasploit Framework post module post/apple_ios/gather/ios_image_gather is affected by a relative path traversal vulnerability (CWE-22). The module interpolates file names taken from a Meterpreter directory listing — data fully controlled by a hostile or t