CVE-2020-7381

In Rapid7 Nexpose installer versions prior to 6.6.40, the Nexpose installer calls an executable which can be placed in the appropriate directory by an attacker with access to the local machine. This would prevent the installer from distinguishing between a valid executable called during a Security Console installation and any arbitrary code executable using the same file name.
References
Configurations

Configuration 1 (hide)

cpe:2.3:a:rapid7:nexpose:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2020-09-03 14:15

Updated : 2024-02-04 21:00


NVD link : CVE-2020-7381

Mitre link : CVE-2020-7381

CVE.ORG link : CVE-2020-7381


JSON object : View

Products Affected

rapid7

  • nexpose
CWE
CWE-94

Improper Control of Generation of Code ('Code Injection')