CVE-2017-5228

2017-03-0220:00:00

rapid7

www.cve.org

0.002 Low

EPSS

Percentile

54.7%

JSON

All editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory traversal vulnerability in the Meterpreter stdapi Dir.download() function. By using a specially-crafted build of Meterpreter, it is possible to write to an arbitrary directory on the Metasploit console with the permissions of the running Metasploit instance.

CNA Affected

[
  {
    "product": "Metasploit",
    "vendor": "Rapid7",
    "versions": [
      {
        "status": "affected",
        "version": "All versions prior to version 4.13.0-2017020701"
      }
    ]
  }
]