docs.rapid7.comrelease notes
https://docs.rapid7.com/release-notes/metasploit/20230130 CVE-2023-0599
MEDIUM
Rapid7 Metasploit Pro Stored XSS
Record summary
CVE-2023-0599 has a selected CVSS score of 6.1 (medium).
Description
Rapid7 Metasploit Pro versions 4.21.2 and lower suffer from a stored cross site scripting vulnerability, due to a lack of JavaScript request string sanitization. Using this vulnerability, an authenticated attacker can execute arbitrary HTML and script code in the target browser against another Metasploit Pro user using a specially crafted request. Note that in most deployments, all Metasploit Pro users tend to enjoy privileges equivalent to local administrator.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 25, 2025 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
Metasploit ProBrowse Rapid7 / Metasploit ProDefault status: unaffected | CVE List | Through 4.21.2 | affected |
References
2nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2023-0599