All editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory traversal vulnerability in the Meterpreter stdapi Dir.download() function. By using a specially-crafted build of Meterpreter, it is possible to write to an arbitrary directory on the Metasploit console with the permissions of the running Metasploit instance.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: rapid7

Published: 2017-03-02T20:00:00

Updated: 2024-08-05T14:55:35.676Z

Reserved: 2017-01-09T00:00:00

Link: CVE-2017-5228

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2017-03-02T20:59:00.267

Modified: 2017-03-21T01:59:02.360

Link: CVE-2017-5228

cve-icon Redhat

No data.