PT-2020-19584 · Rapid7 · Nexpose

Published 2020-09-03 · Updated 2020-09-11 · CVE-2020-7381

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rapid7 Nexpose installer versions prior to 6.6.40

Description The issue arises when the Nexpose installer calls an executable that can be replaced by an attacker with access to the local machine. This allows the attacker to execute arbitrary code, as the installer cannot distinguish between a valid executable and malicious code with the same file name.

Recommendations For versions prior to 6.6.40, update to version 6.6.40 or later to resolve the issue.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2020-7381

Affected Products

Nexpose

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2020-7381 · Security Note
• https://osv.dev/vulnerability/CVE-2020-7381 · Vendor Advisory
• https://help.rapid7.com/insightvm/en-us/release-notes/index.html?pid=6.6.40 · Vendor Advisory