CVE-2020-7384CWE-77
Client-Side Command Injection in Rapid7 Metasploit
High · published October 29, 2020
What it is
Rapid7's Metasploit msfvenom framework handles APK files in a way that allows for a malicious user to craft and publish a file that would execute arbitrary commands on a victim's machine.
The record
Technical detail
- CVSS v3.1
- 7.0 · HIGH
- Vector
- CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS v4.0
- Not supplied
- EPSS
- 0.30463 · 98.2th percentile
- Weakness
- CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
- Published
- 2020-10-29T14:05Z
EPSS history
Timeline