6.1

CVE-2020-7354

Exploit
Cross-site Scripting (XSS) vulnerability in the 'host' field of a discovered scan asset in Rapid7 Metasploit Pro allows an attacker with a specially-crafted network service of a scan target to store an XSS sequence in the Metasploit Pro console, which will trigger when the operator views the record of that scanned host in the Metasploit Pro interface. This issue affects Rapid7 Metasploit Pro version 4.17.1-20200427 and prior versions, and is fixed in Metasploit Pro version 4.17.1-20200514. See also CVE-2020-7355, which describes a similar issue, but involving the generated 'notes' field of a discovered scan asset.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Rapid7 ≫ Metasploit SwEditionpro Version < 4.17.1
Rapid7 ≫ Metasploit Version4.17.1 Update- SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20170221 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20170323 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20170405 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20170419 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20170510 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20170518 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20170530 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20170613 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20170627 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20170718 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20170731 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20170816 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20170828 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20170914 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20170926 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20171009 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20171030 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20171115 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20171129 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20171206 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20171220 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20180108 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20180124 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20180206 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20180301 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20180312 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20180327 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20180410 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20180501 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20180511 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20180526 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20180618 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20180704 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20180716 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20180727 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20180813 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20180827 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20180907 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20180924 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20181009 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20181022 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20181105 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20181130 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20181215 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20190108 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20190118 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20190201 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20190219 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20190303 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20190319 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20190331 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20190416 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20190426 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20190513 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20190603 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20190607 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20190626 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20190722 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20190805 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20190819 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20190910 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20190930 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20191014 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20191030 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20191108 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20191209 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20200113 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20200122 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20200131 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20200218 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20200302 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20200318 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20200330 SwEditionpro
Rapid7 ≫ Metasploit Version4.17.1 Update20200413 SwEditionpro
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.43% 0.615
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.4 2.8 2.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
cve@rapid7.com 6.1 0.9 5.2
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.