CVE-2020-7376

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The Metasploit Framework module "post/osx/gather/enum_osx module" is affected by a relative path traversal vulnerability in the get_keychains method which can be exploited to write arbitrary files to arbitrary locations on the host filesystem when the module is run on a malicious host.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-23 CWE-22

Affected software

Vendor	Product	Versions
Rapid7	Metasploit Framework	>= 4.11.7, < 4.11.7*; >= 6.0.3, < 6.0.3

References

https://github.com/rapid7/metasploit-framework/issues/14008Exploit, Patch, Third Party Advisory
https://github.com/rapid7/metasploit-framework/issues/14008Exploit, Patch, Third Party Advisory

Timeline

Published: Aug 24, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-73777.5The Metasploit Framework module "auxiliary/admin/http/telpho10_credential_dump" module is affected by a relative path traversal vulnerabilit CVE-2020-73789.1CRIXP OpenCRX version 4.30 and 5.0-20200717 and prior suffers from an unverified password change vulnerability. An attacker who is able to c CVE-2020-73817.8In Rapid7 Nexpose installer versions prior to 6.6.40, the Nexpose installer calls an executable which can be placed in the appropriate direc CVE-2020-73826.5Rapid7 Nexpose installer version prior to 6.6.40 contains an Unquoted Search Path which may allow an attacker on the local machine to insert CVE-2020-73838.1A SQL Injection issue in Rapid7 Nexpose version prior to 6.6.49 that may have allowed an authenticated user with a low permission level to a CVE-2020-73847.8Rapid7's Metasploit msfvenom framework handles APK files in a way that allows for a malicious user to craft and publish a file that would ex CVE-2020-73858.8By launching the drb_remote_codeexec exploit, a Metasploit Framework user will inadvertently expose Metasploit to the same deserialization i CVE-2020-73875.3Sage X3 Installation Pathname Disclosure. A specially crafted packet can elicit a response from the AdxDSrv.exe component that reveals the i CVE-2020-73889.8Sage X3 Unauthenticated Remote Command Execution (RCE) as SYSTEM in AdxDSrv.exe component. By editing the client side authentication request CVE-2020-73897.2Sage X3 System CHAINE Variable Script Command Injection. An authenticated user with developer access can pass OS commands via this variable CVE-2020-73905.4Sage X3 Stored XSS Vulnerability on ‘Edit’ Page of User Profile. An authenticated user can pass XSS strings the "First Name," "Last Name," a CVE-2020-74509.8In FreeBSD 12.1-STABLE before r357213, 12.1-RELEASE before 12.1-RELEASE-p2, 12.0-RELEASE before 12.0-RELEASE-p13, 11.3-STABLE before r357214