All editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory traversal vulnerability in the Meterpreter stdapi CommandDispatcher.cmd_download() function. By using a specially-crafted build of Meterpreter, it is possible to write to an arbitrary directory on the Metasploit console with the permissions of the running Metasploit instance.
Metrics
Affected Vendors & Products
References
History
No history.

Status: PUBLISHED
Assigner: rapid7
Published:
Updated: 2024-08-05T14:55:35.636Z
Reserved: 2017-01-09T00:00:00
Link: CVE-2017-5231

No data.

Status : Modified
Published: 2017-03-02T20:59:00.610
Modified: 2024-11-21T03:27:19.950
Link: CVE-2017-5231

No data.