CVEvulnerability

CVE-2020-7358

6.5 MEDIUM Published 2020-09-18 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-09-18
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.8 MEDIUM — CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
4.4 MEDIUM — AV:L/AC:M/Au:N/C:P/I:P/A:P
Weaknesses
CWE-427

Description

In AppSpider installer versions prior to 7.2.126, the AppSpider installer calls an executable which can be placed in the appropriate directory by an attacker with access to the local machine. This would prevent the installer from distinguishing between a valid executable called during an installation and any arbitrary code executable using the same file name.

Affected configurations

• rapid7 appspider (< 7.2.126)

Related

Weakness · CWE (1)

  • CWE-427 Uncontrolled Search Path Element weakness

References