CVE-2019-5642 — MAGICK
Rapid7 Metasploit Pro version 4.16.0-2019081901 and prior suffers from an instance of CWE-732, wherein the unique server.key is written to the file system during installation wi…
Published: 2019-11-06 · CVSS: 3.3 · CVSS 3.1
Rapid7 Metasploit Pro version 4.16.0-2019081901 and prior suffers from an instance of CWE-732, wherein the unique server.key is written to the file system during installation with world-readable permissions. This can allow other users of the same system where Metasploit Pro is installed to intercept otherwise private communications to the Metasploit Pro web interface.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7