CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2020-7350

Rapid7 Metasploit Framework versions before 5.0.85 suffers from an instance of CWE-78: OS Command Injection, wherein the libnotify plugin accepts untrusted user-supplied data via a remote computer's hostname or service name. An attacker can create a specially-crafted hostname or service name to be imported by Metasploit from a variety of sources and trigger a command injection on the operator's terminal. Note, only the Metasploit Framework and products that expose the plugin system is susceptible to this issue -- notably, this does not include Rapid7 Metasploit Pro. Also note, this vulnerability cannot be triggered through a normal scan operation -- the attacker would have to supply a file that is processed with the db_import command.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.587

EPSS Ranking 98.1%

CVSS Severity

CVSS v3 Score 6.1

CVSS v2 Score 6.8

References

Products affected by CVE-2020-7350

Rapid7 » Metasploit » Version: 4.11.7

cpe:2.3:a:rapid7:metasploit:4.11.7
Rapid7 » Metasploit » Version: 4.12.40

cpe:2.3:a:rapid7:metasploit:4.12.40
Rapid7 » Metasploit » Version: 4.13.0

cpe:2.3:a:rapid7:metasploit:4.13.0
Rapid7 » Metasploit » Version: 4.13.1

cpe:2.3:a:rapid7:metasploit:4.13.1
Rapid7 » Metasploit » Version: 4.13.19

cpe:2.3:a:rapid7:metasploit:4.13.19
Rapid7 » Metasploit » Version: 4.14.0

cpe:2.3:a:rapid7:metasploit:4.14.0
Rapid7 » Metasploit » Version: 4.14.1

cpe:2.3:a:rapid7:metasploit:4.14.1
Rapid7 » Metasploit » Version: 4.14.2

cpe:2.3:a:rapid7:metasploit:4.14.2
Rapid7 » Metasploit » Version: 4.14.3

cpe:2.3:a:rapid7:metasploit:4.14.3
Rapid7 » Metasploit » Version: 4.15.0

cpe:2.3:a:rapid7:metasploit:4.15.0
Rapid7 » Metasploit » Version: 4.15.1

cpe:2.3:a:rapid7:metasploit:4.15.1
Rapid7 » Metasploit » Version: 4.16.0

cpe:2.3:a:rapid7:metasploit:4.16.0
Rapid7 » Metasploit » Version: 4.17.1

cpe:2.3:a:rapid7:metasploit:4.17.1
Rapid7 » Metasploit » Version: 4.19.0

cpe:2.3:a:rapid7:metasploit:4.19.0
Rapid7 » Metasploit » Version: 5.0.0

cpe:2.3:a:rapid7:metasploit:5.0.0
Rapid7 » Metasploit » Version: 5.0.1

cpe:2.3:a:rapid7:metasploit:5.0.1
Rapid7 » Metasploit » Version: 5.0.10

cpe:2.3:a:rapid7:metasploit:5.0.10
Rapid7 » Metasploit » Version: 5.0.11

cpe:2.3:a:rapid7:metasploit:5.0.11
Rapid7 » Metasploit » Version: 5.0.12

cpe:2.3:a:rapid7:metasploit:5.0.12
Rapid7 » Metasploit » Version: 5.0.13

cpe:2.3:a:rapid7:metasploit:5.0.13
Rapid7 » Metasploit » Version: 5.0.14

cpe:2.3:a:rapid7:metasploit:5.0.14
Rapid7 » Metasploit » Version: 5.0.15

cpe:2.3:a:rapid7:metasploit:5.0.15
Rapid7 » Metasploit » Version: 5.0.16

cpe:2.3:a:rapid7:metasploit:5.0.16
Rapid7 » Metasploit » Version: 5.0.17

cpe:2.3:a:rapid7:metasploit:5.0.17
Rapid7 » Metasploit » Version: 5.0.18

cpe:2.3:a:rapid7:metasploit:5.0.18
Rapid7 » Metasploit » Version: 5.0.19

cpe:2.3:a:rapid7:metasploit:5.0.19
Rapid7 » Metasploit » Version: 5.0.2

cpe:2.3:a:rapid7:metasploit:5.0.2
Rapid7 » Metasploit » Version: 5.0.20

cpe:2.3:a:rapid7:metasploit:5.0.20
Rapid7 » Metasploit » Version: 5.0.21

cpe:2.3:a:rapid7:metasploit:5.0.21
Rapid7 » Metasploit » Version: 5.0.22

cpe:2.3:a:rapid7:metasploit:5.0.22
Rapid7 » Metasploit » Version: 5.0.23

cpe:2.3:a:rapid7:metasploit:5.0.23
Rapid7 » Metasploit » Version: 5.0.24

cpe:2.3:a:rapid7:metasploit:5.0.24
Rapid7 » Metasploit » Version: 5.0.25

cpe:2.3:a:rapid7:metasploit:5.0.25
Rapid7 » Metasploit » Version: 5.0.26

cpe:2.3:a:rapid7:metasploit:5.0.26
Rapid7 » Metasploit » Version: 5.0.27

cpe:2.3:a:rapid7:metasploit:5.0.27
Rapid7 » Metasploit » Version: 5.0.28

cpe:2.3:a:rapid7:metasploit:5.0.28
Rapid7 » Metasploit » Version: 5.0.29

cpe:2.3:a:rapid7:metasploit:5.0.29
Rapid7 » Metasploit » Version: 5.0.3

cpe:2.3:a:rapid7:metasploit:5.0.3
Rapid7 » Metasploit » Version: 5.0.30

cpe:2.3:a:rapid7:metasploit:5.0.30
Rapid7 » Metasploit » Version: 5.0.31

cpe:2.3:a:rapid7:metasploit:5.0.31
Rapid7 » Metasploit » Version: 5.0.32

cpe:2.3:a:rapid7:metasploit:5.0.32
Rapid7 » Metasploit » Version: 5.0.34

cpe:2.3:a:rapid7:metasploit:5.0.34
Rapid7 » Metasploit » Version: 5.0.35

cpe:2.3:a:rapid7:metasploit:5.0.35
Rapid7 » Metasploit » Version: 5.0.36

cpe:2.3:a:rapid7:metasploit:5.0.36
Rapid7 » Metasploit » Version: 5.0.37

cpe:2.3:a:rapid7:metasploit:5.0.37
Rapid7 » Metasploit » Version: 5.0.38

cpe:2.3:a:rapid7:metasploit:5.0.38
Rapid7 » Metasploit » Version: 5.0.39

cpe:2.3:a:rapid7:metasploit:5.0.39
Rapid7 » Metasploit » Version: 5.0.4

cpe:2.3:a:rapid7:metasploit:5.0.4
Rapid7 » Metasploit » Version: 5.0.40

cpe:2.3:a:rapid7:metasploit:5.0.40
Rapid7 » Metasploit » Version: 5.0.41

cpe:2.3:a:rapid7:metasploit:5.0.41
Rapid7 » Metasploit » Version: 5.0.42

cpe:2.3:a:rapid7:metasploit:5.0.42
Rapid7 » Metasploit » Version: 5.0.43

cpe:2.3:a:rapid7:metasploit:5.0.43
Rapid7 » Metasploit » Version: 5.0.44

cpe:2.3:a:rapid7:metasploit:5.0.44
Rapid7 » Metasploit » Version: 5.0.45

cpe:2.3:a:rapid7:metasploit:5.0.45
Rapid7 » Metasploit » Version: 5.0.46

cpe:2.3:a:rapid7:metasploit:5.0.46
Rapid7 » Metasploit » Version: 5.0.47

cpe:2.3:a:rapid7:metasploit:5.0.47
Rapid7 » Metasploit » Version: 5.0.48

cpe:2.3:a:rapid7:metasploit:5.0.48
Rapid7 » Metasploit » Version: 5.0.49

cpe:2.3:a:rapid7:metasploit:5.0.49
Rapid7 » Metasploit » Version: 5.0.5

cpe:2.3:a:rapid7:metasploit:5.0.5
Rapid7 » Metasploit » Version: 5.0.50

cpe:2.3:a:rapid7:metasploit:5.0.50
Rapid7 » Metasploit » Version: 5.0.52

cpe:2.3:a:rapid7:metasploit:5.0.52
Rapid7 » Metasploit » Version: 5.0.53

cpe:2.3:a:rapid7:metasploit:5.0.53
Rapid7 » Metasploit » Version: 5.0.54

cpe:2.3:a:rapid7:metasploit:5.0.54
Rapid7 » Metasploit » Version: 5.0.55

cpe:2.3:a:rapid7:metasploit:5.0.55
Rapid7 » Metasploit » Version: 5.0.56

cpe:2.3:a:rapid7:metasploit:5.0.56
Rapid7 » Metasploit » Version: 5.0.57

cpe:2.3:a:rapid7:metasploit:5.0.57
Rapid7 » Metasploit » Version: 5.0.58

cpe:2.3:a:rapid7:metasploit:5.0.58
Rapid7 » Metasploit » Version: 5.0.59

cpe:2.3:a:rapid7:metasploit:5.0.59
Rapid7 » Metasploit » Version: 5.0.6

cpe:2.3:a:rapid7:metasploit:5.0.6
Rapid7 » Metasploit » Version: 5.0.60

cpe:2.3:a:rapid7:metasploit:5.0.60
Rapid7 » Metasploit » Version: 5.0.61

cpe:2.3:a:rapid7:metasploit:5.0.61
Rapid7 » Metasploit » Version: 5.0.62

cpe:2.3:a:rapid7:metasploit:5.0.62
Rapid7 » Metasploit » Version: 5.0.63

cpe:2.3:a:rapid7:metasploit:5.0.63
Rapid7 » Metasploit » Version: 5.0.64

cpe:2.3:a:rapid7:metasploit:5.0.64
Rapid7 » Metasploit » Version: 5.0.65

cpe:2.3:a:rapid7:metasploit:5.0.65
Rapid7 » Metasploit » Version: 5.0.66

cpe:2.3:a:rapid7:metasploit:5.0.66
Rapid7 » Metasploit » Version: 5.0.67

cpe:2.3:a:rapid7:metasploit:5.0.67
Rapid7 » Metasploit » Version: 5.0.68

cpe:2.3:a:rapid7:metasploit:5.0.68
Rapid7 » Metasploit » Version: 5.0.69

cpe:2.3:a:rapid7:metasploit:5.0.69
Rapid7 » Metasploit » Version: 5.0.7

cpe:2.3:a:rapid7:metasploit:5.0.7
Rapid7 » Metasploit » Version: 5.0.70

cpe:2.3:a:rapid7:metasploit:5.0.70
Rapid7 » Metasploit » Version: 5.0.71

cpe:2.3:a:rapid7:metasploit:5.0.71
Rapid7 » Metasploit » Version: 5.0.72

cpe:2.3:a:rapid7:metasploit:5.0.72
Rapid7 » Metasploit » Version: 5.0.73

cpe:2.3:a:rapid7:metasploit:5.0.73
Rapid7 » Metasploit » Version: 5.0.74

cpe:2.3:a:rapid7:metasploit:5.0.74
Rapid7 » Metasploit » Version: 5.0.75

cpe:2.3:a:rapid7:metasploit:5.0.75
Rapid7 » Metasploit » Version: 5.0.76

cpe:2.3:a:rapid7:metasploit:5.0.76
Rapid7 » Metasploit » Version: 5.0.77

cpe:2.3:a:rapid7:metasploit:5.0.77
Rapid7 » Metasploit » Version: 5.0.78

cpe:2.3:a:rapid7:metasploit:5.0.78
Rapid7 » Metasploit » Version: 5.0.79

cpe:2.3:a:rapid7:metasploit:5.0.79
Rapid7 » Metasploit » Version: 5.0.8

cpe:2.3:a:rapid7:metasploit:5.0.8
Rapid7 » Metasploit » Version: 5.0.80

cpe:2.3:a:rapid7:metasploit:5.0.80
Rapid7 » Metasploit » Version: 5.0.81

cpe:2.3:a:rapid7:metasploit:5.0.81
Rapid7 » Metasploit » Version: 5.0.82

cpe:2.3:a:rapid7:metasploit:5.0.82
Rapid7 » Metasploit » Version: 5.0.83

cpe:2.3:a:rapid7:metasploit:5.0.83
Rapid7 » Metasploit » Version: 5.0.84

cpe:2.3:a:rapid7:metasploit:5.0.84
Rapid7 » Metasploit » Version: 5.0.9

cpe:2.3:a:rapid7:metasploit:5.0.9

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2020-7350

Products

Pricing

Contact Us