CVE-2020-7382 Unquoted Path in Rapid7 Nexpose Installer
Local attackers can execute arbitrary code with elevated privileges by exploiting an unquoted search path in the installer.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-7382?
CVE-2020-7382 is a medium-severity vulnerability in Rapid7 Nexpose, published on 3 Sep 2020. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Rapid7 Nexpose installer version prior to 6.6.40 contains an Unquoted Search Path which may allow an attacker on the local machine to insert an arbitrary file into the executable path. This issue affects: Rapid7 Nexpose versions prior to 6.6.40.
Weakness: CWE-428
Which versions are affected by CVE-2020-7382?
It affects 1 product.
Products include Rapid7 Nexpose.
How do I fix CVE-2020-7382?
No fix has been published for CVE-2020-7382 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-7382 being exploited?
There is no known exploitation of CVE-2020-7382 in the wild and no public exploit code.
Other vulnerabilities in Rapid7 Nexpose
Sources
Also known as GHSA-8qv2-vfh9-c6v7.