Metasploit におけるクロスサイトリクエストフォージェリの脆弱性
| Title |
Metasploit におけるクロスサイトリクエストフォージェリの脆弱性
|
| Summary |
Metasploit には、クロスサイトリクエストフォージェリの脆弱性が存在します。
|
| Possible impacts |
サービス運用妨害 (DoS) 状態にされる可能性があります。 |
| Solution |
ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。 |
| Publication Date |
May 27, 2017, midnight |
| Registration Date |
July 21, 2017, 4:59 p.m. |
| Last Update |
July 21, 2017, 4:59 p.m. |
|
CVSS3.0 : 低
|
| Score |
3.5
|
| Vector |
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L |
|
CVSS2.0 : 注意
|
| Score |
3.5
|
| Vector |
AV:N/AC:M/Au:S/C:N/I:N/A:P |
Affected System
| Rapid7 |
|
Metasploit 4.14.0 未満
|
CVE (情報セキュリティ 共通脆弱性識別子)
CWE (共通脆弱性タイプ一覧)
ベンダー情報
Change Log
| No |
Changed Details |
Date of change |
| 0 |
[2017年07月21日]
掲載 |
Feb. 17, 2018, 10:37 a.m. |
NVD Vulnerability Information
CVE-2017-5244
| Summary |
Routes used to stop running Metasploit tasks (either particular ones or all tasks) allowed GET requests. Only POST requests should have been allowed, as the stop/stop_all routes change the state of the service. This could have allowed an attacker to stop currently-running Metasploit tasks by getting an authenticated user to execute JavaScript. As of Metasploit 4.14.0 (Update 2017061301), the routes for stopping tasks only allow POST requests, which validate the presence of a secret token to prevent CSRF attacks.
|
| Publication Date |
June 15, 2017, 11:29 p.m. |
| Registration Date |
Jan. 26, 2021, 1:25 p.m. |
| Last Update |
Nov. 21, 2024, 12:27 p.m. |
Affected software configurations
| Configuration1 |
or higher |
or less |
more than |
less than |
| cpe:2.3:a:rapid7:metasploit:*:*:*:*:*:*:*:* |
|
4.13.19 |
|
|
Related information, measures and tools
Common Vulnerabilities List