CVE-2020-7382 - Unquoted Path in Rapid7 Nexpose Installer

Back Back to CVE browser

MEDIUM

Unquoted Path in Rapid7 Nexpose Installer

Published Sep 3, 2020

6.8

MEDIUM

CVSS 3.1

EPSS 0.29%

Description

Rapid7 Nexpose installer version prior to 6.6.40 contains an Unquoted Search Path which may allow an attacker on the local machine to insert an arbitrary file into the executable path. This issue affects: Rapid7 Nexpose versions prior to 6.6.40.

Affected products

Vendor Rapid7 Product Nexpose Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <6.6.40

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Rapid7

Nexpose

n/a

Version	Status	Constraints
unspecified	affected	<6.6.40

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-428

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-28509
Advisory
https://help.rapid7.com/insightvm/en-us/release-notes/index.html?pid=6.6.40
x_refsource_MISCRelease NotesVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-28509		Advisory
https://help.rapid7.com/insightvm/en-us/release-notes/index.html?pid=6.6.40		x_refsource_MISCRelease NotesVendor Advisory