CVE-2020-7355: 
Rapid7 Metasploit vulnerability analysis and mitigation

A Cross-site Scripting (XSS) vulnerability was identified in Rapid7 Metasploit Pro, specifically affecting the 'notes' field of discovered scan assets. The vulnerability, tracked as CVE-2020-7355, was discovered and assigned on January 21, 2020. It affects Metasploit Pro version 4.17.1-20200427 and prior versions. The vulnerability allows attackers to store malicious XSS sequences in the Metasploit Pro console through specially-crafted network services of scan targets (CVE Details).

The vulnerability exists in the 'notes' field of discovered scan assets in the Metasploit Pro interface. When an operator views the record of a scanned host containing the malicious payload, the stored XSS sequence is triggered. This vulnerability is related to CVE-2020-7354, which describes a similar issue but affects the 'host' field instead of the 'notes' field (CVE Details).

When exploited, this vulnerability allows attackers to execute malicious scripts when operators view affected host records in the Metasploit Pro interface. The stored XSS payload can potentially lead to unauthorized actions being performed with the privileges of the viewing operator (CVE Details).

The vulnerability requires an attacker to have the ability to create specially-crafted network services that will be scanned by Metasploit Pro. The XSS payload is stored when these services are scanned and triggered when viewing the scan results (CVE Details).

The vulnerability has been fixed in Metasploit Pro version 4.17.1-20200514. Users are advised to upgrade to this version or later to mitigate the risk. The fix was released as part of Rapid7's security updates in May 2020 (Rapid7 Release).