CVE-2020-7377: falha de alta gravidade em Rapid7 Metasploit Framework
Rapid7 Metasploit Framework Relative Path Traversal in telpho10_credential_dump module
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.1epss 1.1%
The Metasploit Framework module "auxiliary/admin/http/telpho10_credential_dump" module is affected by a relative path traversal vulnerability in the untar method which can be exploited to write arbitrary files to arbitrary locations on the host file system when the module is run on a malicious HTTP server.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Produtos afetados
Rapid7 · Metasploit FrameworkCVEs relacionadas — Rapid7 Metasploit Framework
No mesmo produto, das mais perigosas para as menos.
CVE-2019-5645HIGHRapid7 Metasploit HTTP Handler Denial of ServiceEPSS 49.2%CVE-2020-7350MEDIUMMetasploit Framework Plugin Libnotify Command InjectionEPSS 5.0%CVE-2019-5624HIGHRapid7 Metasploit Framework Zip Import Directory TraversalEPSS 2.8%CVE-2020-7385HIGHMetasploit Framework 'drb_remote_codeexec' code executionEPSS 1.8%CVE-2020-7376HIGHRapid7 Metasploit Framework Relative Path Traversal in enum_osx moduleEPSS 1.1%CVE-2026-87690HIGHMetasploit Framework ios_image_gather Path Traversal Leading to Arbitrary File Write and Code ExecutionEPSS 0.4%