PT-2020-4730 · Rapid7 · Nexpose

Mikhail Klyuchnikov · Published 2020-10-14 · Updated 2021-07-16 · CVE-2020-7383

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions: Rapid7 Nexpose versions prior to 6.6.49

Description: The issue is related to insufficient protection of the SQL query structure, which may allow a remote attacker to elevate their privileges. It is a SQL Injection issue that may have allowed an authenticated user with a low permission level to access resources and make changes they should not have been able to access.

Recommendations: For versions prior to 6.6.49, update to version 6.6.49 or later to resolve the issue. As a temporary workaround, consider restricting access to the SQL query structure to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2020-05282

CVE-2020-7383

Affected Products

Nexpose

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2020-7383 · Security Note
• https://help.rapid7.com/insightvm/en-us/release-notes/index.html?pid=6.6.49 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-7383 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-05282 · Security Note
• https://t.me/ptswarm/54 · Telegram Post
• https://safe.cnews.ru/news/line/2020-10-26_ustranena_uyazvimost_v_skanere · Note
• https://t.me/cibsecurity/15276 · Telegram Post