Vulnerability Description
In Rapid7 Nexpose installer versions prior to 6.6.40, the Nexpose installer calls an executable which can be placed in the appropriate directory by an attacker with access to the local machine. This would prevent the installer from distinguishing between a valid executable called during a Security Console installation and any arbitrary code executable using the same file name.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Rapid7 | Nexpose | < 6.6.40 |
Related Weaknesses (CWE)
References
- https://help.rapid7.com/insightvm/en-us/release-notes/index.html?pid=6.6.40Release NotesVendor Advisory
- https://help.rapid7.com/insightvm/en-us/release-notes/index.html?pid=6.6.40Release NotesVendor Advisory
FAQ
What is CVE-2020-7381?
CVE-2020-7381 is a vulnerability with a CVSS score of 5.8 (MEDIUM). In Rapid7 Nexpose installer versions prior to 6.6.40, the Nexpose installer calls an executable which can be placed in the appropriate directory by an attacker with access to the local machine. This w...
How severe is CVE-2020-7381?
CVE-2020-7381 has been rated MEDIUM with a CVSS base score of 5.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-7381?
Check the references section above for vendor advisories and patch information. Affected products include: Rapid7 Nexpose.