VulnerabilityModified
CVE-2011-1056
The installer for Metasploit Framework 3.5.1, when running on Windows, uses weak inherited permissions for the Metasploit installation directory, which allows local users to gain privileges by replacing critical files with a Trojan horse.
MEDIUM 6.2EPSS 0.28%
Does this matter?
Lower severity and a low EPSS score (0.28%). Track it; it rarely justifies an emergency change on its own.
Description
The installer for Metasploit Framework 3.5.1, when running on Windows, uses weak inherited permissions for the Metasploit installation directory, which allows local users to gain privileges by replacing critical files with a Trojan horse.
- CVSS 2.0
- 6.2 MEDIUMAV:L/AC:H/Au:N/C:C/I:C/A:C
- EPSS
- 0.28% probability · 20th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- metasploit/metasploit framework
- Source
- cve@mitre.org
References
- http://blog.metasploit.com/2011/02/metasploit-framework-352-released.html
- http://osvdb.org/70857
- http://secunia.com/advisories/43166Vendor Advisory
- http://www.vupen.com/english/advisories/2011/0371Vendor Advisory
- http://blog.metasploit.com/2011/02/metasploit-framework-352-released.html
- http://osvdb.org/70857
- http://secunia.com/advisories/43166Vendor Advisory
- http://www.vupen.com/english/advisories/2011/0371Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.