Unquoted Path in Rapid7 Nexpose Installer
CVE-2020-7382

6.8MEDIUM

Key Information:

Vendor

Rapid7

Status
Nexpose
Vendor
CVE Published:
3 September 2020

What is CVE-2020-7382?

Rapid7 Nexpose installer version prior to 6.6.40 contains an Unquoted Search Path which may allow an attacker on the local machine to insert an arbitrary file into the executable path. This issue affects: Rapid7 Nexpose versions prior to 6.6.40.

Affected Version(s)

Nexpose < 6.6.40

References

https://help.rapid7.com/insightvm/en-us/release-notes/ind...
x_refsource_MISC

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Physical
Attack Complexity:
High
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This issue was discovered and reported by Angelo D'Amato.
.