« Volver al listado

CVE-2019-5642

Estado: ModificadaBaja (3.3)—

Rapid7 Metasploit Pro version 4.16.0-2019081901 and prior suffers from an instance of CWE-732, wherein the unique server.key is written to the file system during installation with world-readable permissions. This can allow other users of the same system where Metasploit Pro is installed to intercept otherwise private communications to the Metasploit Pro web interface.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Rapid7 — Metasploit

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-5642",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 2.1,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cve@rapid7.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 3.3,
          "attackVector": "LOCAL",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 1.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 3.3,
          "attackVector": "LOCAL",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@rapid7.com",
      "affectedData": [
        {
          "vendor": "Rapid7",
          "product": "Metasploit Pro",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom",
              "lessThanOrEqual": "4.16.0-2019081901"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-11-06T19:15:12.360",
  "references": [
    {
      "url": "https://help.rapid7.com/metasploit/release-notes/?rid=4.16.0-2019091001",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "cve@rapid7.com"
    },
    {
      "url": "https://help.rapid7.com/metasploit/release-notes/?rid=4.16.0-2019091001",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve@rapid7.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-732"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-732"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Rapid7 Metasploit Pro version 4.16.0-2019081901 and prior suffers from an instance of CWE-732, wherein the unique server.key is written to the file system during installation with world-readable permissions. This can allow other users of the same system where Metasploit Pro is installed to intercept otherwise private communications to the Metasploit Pro web interface."
    },
    {
      "lang": "es",
      "value": "Rapid7 Metasploit Pro versión 4.16.0-2019081901 y anterior, sufre de una instancia de CWE-732, en la que el único server.key es escrito en el sistema de archivos durante la instalación con permisos de tipo world-readable. Esto puede permitir a otros usuarios del mismo sistema donde está instalado Metasploit Pro, por otra parte interceptar comunicaciones privadas a la interfaz web de Metasploit Pro."
    }
  ],
  "lastModified": "2026-06-17T02:38:00.987",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:rapid7:metasploit:*:*:*:*:pro:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D0955FF0-9FB8-48BE-AF5F-8DE42FD0C143",
              "versionEndExcluding": "4.16.0"
            },
            {
              "criteria": "cpe:2.3:a:rapid7:metasploit:4.16.0:-:*:*:pro:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "35954372-1852-47D3-B920-E9E4AABD6B69"
            },
            {
              "criteria": "cpe:2.3:a:rapid7:metasploit:4.16.0:20190722:*:*:pro:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "40954A9F-1E07-45A5-AA7C-0AC8C4B478BF"
            },
            {
              "criteria": "cpe:2.3:a:rapid7:metasploit:4.16.0:20190805:*:*:pro:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FBD2D8F1-294E-4E6A-B78F-EB3181F2B224"
            },
            {
              "criteria": "cpe:2.3:a:rapid7:metasploit:4.16.0:2019081901:*:*:pro:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E78CB217-64EC-4276-A4CB-7D0DAF1E378D"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@rapid7.com"
}