Vulnerability Description
In AppSpider installer versions prior to 7.2.126, the AppSpider installer calls an executable which can be placed in the appropriate directory by an attacker with access to the local machine. This would prevent the installer from distinguishing between a valid executable called during an installation and any arbitrary code executable using the same file name.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Rapid7 | Appspider | < 7.2.126 |
Related Weaknesses (CWE)
References
- https://help.rapid7.com/appspider/release-notes/index.html?pid=7.2.126Release NotesVendor Advisory
- https://help.rapid7.com/appspider/release-notes/index.html?pid=7.2.126Release NotesVendor Advisory
FAQ
What is CVE-2020-7358?
CVE-2020-7358 is a vulnerability with a CVSS score of 5.8 (MEDIUM). In AppSpider installer versions prior to 7.2.126, the AppSpider installer calls an executable which can be placed in the appropriate directory by an attacker with access to the local machine. This wou...
How severe is CVE-2020-7358?
CVE-2020-7358 has been rated MEDIUM with a CVSS base score of 5.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-7358?
Check the references section above for vendor advisories and patch information. Affected products include: Rapid7 Appspider.