CVE-2020-7384

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Rapid7's Metasploit msfvenom framework handles APK files in a way that allows for a malicious user to craft and publish a file that would execute arbitrary commands on a victim's machine.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

Vendor	Product	Versions
Rapid7	Metasploit	>= unspecified, < 4.19.0

References

http://packetstormsecurity.com/files/160004/Rapid7-Metasploit-Framework-msfvenom-APK-Template-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/161200/Metasploit-Framework-6.0.11-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
https://github.com/rapid7/metasploit-framework/pull/14288Exploit, Patch, Third Party Advisory
http://packetstormsecurity.com/files/160004/Rapid7-Metasploit-Framework-msfvenom-APK-Template-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/161200/Metasploit-Framework-6.0.11-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
https://github.com/rapid7/metasploit-framework/pull/14288Exploit, Patch, Third Party Advisory

Timeline

Published: Oct 29, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-73858.8By launching the drb_remote_codeexec exploit, a Metasploit Framework user will inadvertently expose Metasploit to the same deserialization i CVE-2020-73875.3Sage X3 Installation Pathname Disclosure. A specially crafted packet can elicit a response from the AdxDSrv.exe component that reveals the i CVE-2020-73889.8Sage X3 Unauthenticated Remote Command Execution (RCE) as SYSTEM in AdxDSrv.exe component. By editing the client side authentication request CVE-2020-73897.2Sage X3 System CHAINE Variable Script Command Injection. An authenticated user with developer access can pass OS commands via this variable CVE-2020-73905.4Sage X3 Stored XSS Vulnerability on ‘Edit’ Page of User Profile. An authenticated user can pass XSS strings the "First Name," "Last Name," a CVE-2020-74509.8In FreeBSD 12.1-STABLE before r357213, 12.1-RELEASE before 12.1-RELEASE-p2, 12.0-RELEASE before 12.0-RELEASE-p13, 11.3-STABLE before r357214 CVE-2020-74515.3In FreeBSD 12.1-STABLE before r358739, 12.1-RELEASE before 12.1-RELEASE-p3, 11.3-STABLE before r358740, and 11.3-RELEASE before 11.3-RELEASE CVE-2020-74529.1In FreeBSD 12.1-STABLE before r357490, 12.1-RELEASE before 12.1-RELEASE-p3, 11.3-STABLE before r357489, and 11.3-RELEASE before 11.3-RELEASE CVE-2020-74536.0In FreeBSD 12.1-STABLE before r359021, 12.1-RELEASE before 12.1-RELEASE-p3, 11.3-STABLE before r359020, and 11.3-RELEASE before 11.3-RELEASE CVE-2020-74549.8In FreeBSD 12.1-STABLE before r360971, 12.1-RELEASE before p5, 11.4-STABLE before r360971, 11.4-BETA1 before p1 and 11.3-RELEASE before p9, CVE-2020-74555.5In FreeBSD 12.1-STABLE before r360973, 12.1-RELEASE before p5, 11.4-STABLE before r360973, 11.4-BETA1 before p1 and 11.3-RELEASE before p9, CVE-2020-74566.8In FreeBSD 12.1-STABLE before r361918, 12.1-RELEASE before p6, 11.4-STABLE before r361919, 11.3-RELEASE before p10, and 11.4-RC2 before p1,