Code Injection in Rapid7 AppSpider Pro Installer
CVE-2020-7358

5.8MEDIUM

Key Information:

Vendor

Rapid7

Status
Appspider
Vendor
CVE Published:
18 September 2020

What is CVE-2020-7358?

In AppSpider installer versions prior to 7.2.126, the AppSpider installer calls an executable which can be placed in the appropriate directory by an attacker with access to the local machine. This would prevent the installer from distinguishing between a valid executable called during an installation and any arbitrary code executable using the same file name.

Affected Version(s)

AppSpider < 7.2.126

References

https://help.rapid7.com/appspider/release-notes/index.htm...
x_refsource_MISC

CVSS V3.1

Score:
5.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This issue was discovered and reported by Mishra Dhiraj.
.
CVE-2020-7358 : Code Injection in Rapid7 AppSpider Pro Installer