CVE-2020-7381

Katalog CVE

CVSS 7.8 · High EPSS 0,68%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada rapid7 nexpose. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

In Rapid7 Nexpose installer versions prior to 6.6.40, the Nexpose installer calls an executable which can be placed in the appropriate directory by an attacker with access to the local machine. This would prevent the installer from distinguishing between a valid executable called during a Security Console installation and any arbitrary code executable using the same file name.

Rincian

Terbit di NVD

3 September 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

0,68% peluang dieksploitasi; lebih tinggi dari 50,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://help.rapid7.com/insightvm/en-us/release-notes/index.html?pid=6.6.40 release notes · advisory vendor