CVE-2020-7381 - Code Injection in Rapid7 Nexpose Installer

Back Back to CVE browser

HIGH

Code Injection in Rapid7 Nexpose Installer

Published Sep 3, 2020

7.8

HIGH

CVSS 3.1

EPSS 0.68%

Description

In Rapid7 Nexpose installer versions prior to 6.6.40, the Nexpose installer calls an executable which can be placed in the appropriate directory by an attacker with access to the local machine. This would prevent the installer from distinguishing between a valid executable called during a Security Console installation and any arbitrary code executable using the same file name.

Affected products

Vendor Rapid7 Product Nexpose Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <6.6.40

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Rapid7

Nexpose

n/a

Version	Status	Constraints
unspecified	affected	<6.6.40

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-94

Code Injection

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-28508
Advisory
https://help.rapid7.com/insightvm/en-us/release-notes/index.html?pid=6.6.40
x_refsource_MISCRelease NotesVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-28508		Advisory
https://help.rapid7.com/insightvm/en-us/release-notes/index.html?pid=6.6.40		x_refsource_MISCRelease NotesVendor Advisory