CVE-2020-7358: Code Injection in Rapid7 AppSpider Pro Installer

Q: What is CVE-2020-7358?

CVE-2020-7358 is a vulnerability in AppSpider installer versions prior to 7.2.126.

Q: How severe is CVE-2020-7358?

CVE-2020-7358 has a severity rating of 6.5 out of 10 (medium).

Q: How can an attacker exploit CVE-2020-7358?

An attacker with access to the local machine can place a malicious executable in the appropriate directory, which the AppSpider installer will call during installation.

Q: Which version of AppSpider is affected by CVE-2020-7358?

AppSpider installer versions prior to 7.2.126 are affected by CVE-2020-7358.

Q: How do I fix CVE-2020-7358?

Upgrade to AppSpider installer version 7.2.126 or later to fix CVE-2020-7358.

Published Sep 18, 2020

Updated

In AppSpider installer versions prior to 7.2.126, the AppSpider installer calls an executable which can be placed in the appropriate directory by an attacker with access to the local machine. This would prevent the installer from distinguishing between a valid executable called during an installation and any arbitrary code executable using the same file name.

Affected Software

1 affected component

Rapid7 AppSpider<7.2.126

Event History

Sep 18, 2020

CVE Published

via MITRE·02:55 PM

Data Sourced

via MITRE·02:55 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2020-7358?

CVE-2020-7358 is a vulnerability in AppSpider installer versions prior to 7.2.126.

How severe is CVE-2020-7358?

CVE-2020-7358 has a severity rating of 6.5 out of 10 (medium).

How can an attacker exploit CVE-2020-7358?

An attacker with access to the local machine can place a malicious executable in the appropriate directory, which the AppSpider installer will call during installation.

Which version of AppSpider is affected by CVE-2020-7358?

AppSpider installer versions prior to 7.2.126 are affected by CVE-2020-7358.

How do I fix CVE-2020-7358?