Incorrect permission assignment in Rapid7 Metasploit Pro
Priority LOW 16CWE-732Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Rapid7 Metasploit Pro version 4.16.0-2019081901 and prior suffers from an instance of CWE-732, wherein the unique server.key is written to the file system during installation with world-readable permissions. This can allow other users of the same system where Metasploit Pro is installed to intercept otherwise private communications to the Metasploit Pro web interface.
Why it matters now
EPSS 0.0031 24th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Rapid7 | Metasploit Pro | up to 4.16.0-2019081901 | — | No fix listed | CNA |
- Metasploit Pro VendorRapid7 Affected up to 4.16.0-2019081901 Fixed in — No fix listed CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:rapid7:metasploit:*:*:*:*:pro:*:*:* | before 4.16.0 | Vulnerable | Rapid7 |
| cpe:2.3:a:rapid7:metasploit:4.16.0:-:*:*:pro:*:*:* | 4.16.0 | Vulnerable | Rapid7 |
| cpe:2.3:a:rapid7:metasploit:4.16.0:20190722:*:*:pro:*:*:* | 4.16.0 20190722 | Vulnerable | Rapid7 |
| cpe:2.3:a:rapid7:metasploit:4.16.0:20190805:*:*:pro:*:*:* | 4.16.0 20190805 | Vulnerable | Rapid7 |
| cpe:2.3:a:rapid7:metasploit:4.16.0:2019081901:*:*:pro:*:*:* | 4.16.0 2019081901 | Vulnerable | Rapid7 |
- cpe:2.3:a:rapid7:metasploit:*:*:*:*:pro:*:*:* Versions before 4.16.0 Vulnerable ·Rapid7
- cpe:2.3:a:rapid7:metasploit:4.16.0:-:*:*:pro:*:*:* Versions 4.16.0 Vulnerable ·Rapid7
- cpe:2.3:a:rapid7:metasploit:4.16.0:20190722:*:*:pro:*:*:* Versions 4.16.0 20190722 Vulnerable ·Rapid7
- cpe:2.3:a:rapid7:metasploit:4.16.0:20190805:*:*:pro:*:*:* Versions 4.16.0 20190805 Vulnerable ·Rapid7
- cpe:2.3:a:rapid7:metasploit:4.16.0:2019081901:*:*:pro:*:*:* Versions 4.16.0 2019081901 Vulnerable ·Rapid7
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2019-5642
- 2026-10-03 Alias added: GHSA-g8mp-gm84-qx6x
References
More Rapid7 Metasploit vulnerabilities
- TI-2019-04008 Rapid7 Metasploit HTTP Handler Denial of Service CVSS 3.1HIGH 7.5
- TI-2020-05967 Client-Side Command Injection in Rapid7 Metasploit CVSS 3.1HIGH 7.8
- TI-2020-05961 Rapid7 Metasploit Framework Relative Path Traversal in enum_osx module CVSS 3.1CRITICAL 9.8
- TI-2020-05968 Metasploit Framework 'drb_remote_codeexec' code execution CVSS 3.1HIGH 8.8
- TI-2020-05944 Metasploit Framework Plugin Libnotify Command Injection CVSS 3.1HIGH 7.8
- TI-2020-05962 Rapid7 Metasploit Framework Relative Path Traversal in telpho10_credential_dump module CVSS 3.1HIGH 8.1
Sources
- CVE-2019-5642 · CVE Program
- CVE-2019-5642 · NVD
- FIRST EPSS
- GHSA-g8mp-gm84-qx6x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences