All editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory traversal vulnerability in the Meterpreter stdapi Dir.download() function. By using a specially-crafted build of Meterpreter, it is possible to write to an arbitrary directory on the Metasploit console with the permissions of the running Metasploit instance.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: rapid7
Published: 2017-03-02T20:00:00
Updated: 2024-08-05T14:55:35.676Z
Reserved: 2017-01-09T00:00:00
Link: CVE-2017-5228
Vulnrichment
No data.
NVD
Status : Modified
Published: 2017-03-02T20:59:00.267
Modified: 2017-03-21T01:59:02.360
Link: CVE-2017-5228
Redhat
No data.