CVE-2020-7381— Rapid7 Nexpose 代码注入漏洞

Code Injection in Rapid7 Nexpose Installer

In Rapid7 Nexpose installer versions prior to 6.6.40, the Nexpose installer calls an executable which can be placed in the appropriate directory by an attacker with access to the local machine. This would prevent the installer from distinguishing between a valid executable called during a Security Console installation and any arbitrary code executable using the same file name.

CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L

对生成代码的控制不恰当(代码注入)

Rapid7 Nexpose 代码注入漏洞

Rapid7 Nexpose是美国Rapid7公司的一套能够利用扫描结果深度探测网络的漏洞管理软件。该软件支持扫描配置环境的错误、漏洞、恶意软件等。 Rapid7 Nexpose 6.6.40之前版本中存在安全漏洞，该漏洞源于Nexpose的安装程序可以调用一个可执行文件，攻击者借助该漏洞调用有效可执行文件。

N/A

N/A