CVE-2020-7355CWE-79

Rapid7 Metasploit Pro Stored XSS in 'notes' field

Medium · published June 25, 2020

CVSS v3.1
6.1
EPSS
1%
Percentile
58.7
In the wild
Unconfirmed
What it is

Cross-site Scripting (XSS) vulnerability in the 'notes' field of a discovered scan asset in Rapid7 Metasploit Pro allows an attacker with a specially-crafted network service of a scan target store an XSS sequence in the Metasploit Pro console, which will trigger when the operator views the record of that scanned host in the Metasploit Pro interface. This issue affects Rapid7 Metasploit Pro version 4.17.1-20200427 and prior versions, and is fixed in Metasploit Pro version 4.17.1-20200514. See also CVE-2020-7354, which describes a similar issue, but involving the generated 'host' field of a discovered scan asset.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00881 · 58.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2020-06-25T17:15Z
EPSS history
Timeline
  • 25 JUN 17:15Z
    Rapid7 Metasploit Pro Stored XSS in 'notes' field
    cvelistv5