PT-2020-19572 · Rapid7 · Appspider

Published 2020-09-18 · Updated 2020-09-28 · CVE-2020-7358

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AppSpider versions prior to 7.2.126

Description The issue arises when the AppSpider installer calls an executable that can be replaced by an attacker with access to the local machine, potentially allowing the execution of arbitrary code. This is due to the installer's inability to distinguish between a valid executable and any other executable with the same file name.

Recommendations For versions prior to 7.2.126, update to version 7.2.126 or later to resolve the issue. As a temporary workaround, consider restricting access to the directory where the executable is located to prevent an attacker from replacing the valid executable with malicious code.

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2020-7358

Affected Products

Appspider

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2020-7358 · Security Note
• https://help.rapid7.com/appspider/release-notes/index.html?pid=7.2.126 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-7358 · Vendor Advisory