Rapid7 Vulnerabilities and Affected Products
Vulnerabilities associated with Metasploit Pro.
Products
Clear product- Velociraptor32 vulnerabilities
- Nexpose17 vulnerabilities
- Insight Agent10 vulnerabilities
- InsightVM9 vulnerabilities
- AppSpider Pro6 vulnerabilities
- Metasploit Framework6 vulnerabilities
- Metasploit Pro6 vulnerabilities
- Metasploit4 vulnerabilities
- InsightCloudSec3 vulnerabilities
- InsightConnect Sed Plugin3 vulnerabilities
- AppSpider2 vulnerabilities
- Insight Platform2 vulnerabilities
- Insight Collector1 vulnerability
- InsightAppSec1 vulnerability
- InsightConnect AWK Plugin1 vulnerability
- InsightConnect Compression Plugin1 vulnerability
- InsightConnect Finger Plugin1 vulnerability
- InsightConnect Markdown Plugin1 vulnerability
- InsightConnect Ping Plugin1 vulnerability
- InsightConnect RPM Plugin1 vulnerability
- InsightConnect SQLmap Plugin1 vulnerability
- InsightConnect Tcpdump Plugin1 vulnerability
- InsightConnect TR Plugin1 vulnerability
- InsightConnect Traceroute Plugin1 vulnerability
- InsightVM Virtual Appliance1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-7373HIGH | Metasploit Pro on Windows: Local Privilege Escalation via OpenSSL Configuration File LoadingRapid7 Metasploit Pro is vulnerable to a local privilege escalation attack that allows a user to gain SYSTEM level control of a Windows host. When started the metasploitPostgreSQL service would start the postgres.exe child process which would in turn load an OpenSSL configuration file from a static location. This static location would be writable by a pre-existing "vagrant" user, if they already existed on the system. Metasploit does not create local accounts, an Administrator would need to crea… | CVSS8.5v4.0 | EPSS0.17% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-0599MEDIUM | Rapid7 Metasploit Pro Stored XSSRapid7 Metasploit Pro versions 4.21.2 and lower suffer from a stored cross site scripting vulnerability, due to a lack of JavaScript request string sanitization. Using this vulnerability, an authenticated attacker can execute arbitrary HTML and script code in the target browser against another Metasploit Pro user using a specially crafted request. Note that in most deployments, all Metasploit Pro users tend to enjoy privileges equivalent to local administrator. CWE-79Feb 1, 2023 | CVSS6.1v3.1 | EPSS0.37% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2020-7355MEDIUM | Rapid7 Metasploit Pro Stored XSS in 'notes' fieldCross-site Scripting (XSS) vulnerability in the 'notes' field of a discovered scan asset in Rapid7 Metasploit Pro allows an attacker with a specially-crafted network service of a scan target store an XSS sequence in the Metasploit Pro console, which will trigger when the operator views the record of that scanned host in the Metasploit Pro interface. This issue affects Rapid7 Metasploit Pro version 4.17.1-20200427 and prior versions, and is fixed in Metasploit Pro version 4.17.1-20200514. See als… CWE-79Jun 25, 2020 | CVSS6.1v3.1 | EPSS0.881% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2020-7354MEDIUM | Rapid7 Metasploit Pro Stored XSS in 'host' fieldCross-site Scripting (XSS) vulnerability in the 'host' field of a discovered scan asset in Rapid7 Metasploit Pro allows an attacker with a specially-crafted network service of a scan target to store an XSS sequence in the Metasploit Pro console, which will trigger when the operator views the record of that scanned host in the Metasploit Pro interface. This issue affects Rapid7 Metasploit Pro version 4.17.1-20200427 and prior versions, and is fixed in Metasploit Pro version 4.17.1-20200514. See a… CWE-79Jun 25, 2020 | CVSS6.1v3.1 | EPSS0.881% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
MAGICKRapid7 Metasploit Pro version 4.16.0-2019081901 and prior suffers from an instance of CWE-732, wherein the unique server.key is written to the file system during installation with world-readable permissions. This can allow other users of the same system where Metasploit Pro is installed to intercept otherwise private communications to the Metasploit Pro web interface. CWE-732Nov 6, 2019 | CVSS3.3v3.1 | EPSS0.31% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2017-5235HIGH | Rapid7 Metasploit Pro installers prior to version 4.13.0-2017022101 contain a DLL preloading vulnerability, wherein it is possible for the installer to load a malicious DLL located in the current working directory of the installer. CWE-426Mar 2, 2017 | CVSS7.8v3.0 | EPSS0.911% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |