CVE-2020-7382CWE-428

Unquoted Path in Rapid7 Nexpose Installer

Medium · published September 3, 2020

CVSS v3.1
6.8
EPSS
0%
Percentile
20.2
In the wild
Unconfirmed
What it is

Rapid7 Nexpose installer version prior to 6.6.40 contains an Unquoted Search Path which may allow an attacker on the local machine to insert an arbitrary file into the executable path. This issue affects: Rapid7 Nexpose versions prior to 6.6.40.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00288 · 20.2th percentile
Weakness
CWE-428 · Unquoted Search Path or Element
Published
2020-09-03T13:55Z
EPSS history
Timeline
  • 03 SEP 13:55Z
    Unquoted Path in Rapid7 Nexpose Installer
    cvelistv5