• Supervisor XML-RPC Authenticated Remote Code Execution
    Disclosure Date: 2017-07-19
    First seen: 2020-04-26
    This module exploits a vulnerability in the Supervisor process control software, where an authenticated client can send a malicious XML-RPC request to supervisord that will run arbitrary shell commands on the server. The commands will be run as the same user as supervisord. Depending on how supervisord has been configured, this may be root. This vulnerability can only be exploited by an authenticated client, or if supervisord has been configured to run an HTTP server without authentication. This vulnerability affects versions 3.0a1 to 3.3.2. Authors: - Calum Hutton <c.e.hutton@gmx.com>
  • Ruby On Rails File Content Disclosure ('doubletap')
    First seen: 2020-04-26
    This module uses a path traversal vulnerability in Ruby on Rails versions =< 5.2.2 to read files on a target server. Authors: - Carter Brainerd <0xCB@protonmail.com> - John Hawthorn <john@hawthorn.email>
2 metasploit modules found
Please note: Metasploit modules are only matched by CVE numbers. Visit metasploit web site for more details
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!