{"id":"CVE-2020-7382","aliases":["EUVD-2020-28509","GHSA-8qv2-vfh9-c6v7"],"status":"published","title":"Unquoted Path in Rapid7 Nexpose Installer","description":"Rapid7 Nexpose installer version prior to 6.6.40 contains an Unquoted Search Path which may allow an attacker on the local machine to insert an arbitrary file into the executable path. This issue affects: Rapid7 Nexpose versions prior to 6.6.40.","severity":{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00288,"percentile":0.21491,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-428"],"published":"2020-09-03T13:55:26Z","modified":"2026-06-17T03:24:47Z","products":[{"vendor":"rapid7","product":"nexpose"}],"references":[{"url":"https://help.rapid7.com/insightvm/en-us/release-notes/index.html?pid=6.6.40","tags":["x_refsource_MISC","x_transferred","Release Notes","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7382"},{"url":"https://github.com/advisories/GHSA-8qv2-vfh9-c6v7"}],"sources":{"cve":[{"id":"CVE-2020-7382","title":"Unquoted Path in Rapid7 Nexpose Installer","description":"Rapid7 Nexpose installer version prior to 6.6.40 contains an Unquoted Search Path which may allow an attacker on the local machine to insert an arbitrary file into the executable path. This issue affects: Rapid7 Nexpose versions prior to 6.6.40.","status":"published","published":"2020-09-03T13:55:26Z","modified":"2024-08-04T09:25:49.039Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-428"],"updated_at":"2026-11-02T14:35:58.331892Z"}],"euvd":[{"id":"EUVD-2020-28509","description":"Rapid7 Nexpose installer version prior to 6.6.40 contains an Unquoted Search Path which may allow an attacker on the local machine to insert an arbitrary file into the executable path. This issue affects: Rapid7 Nexpose versions prior to 6.6.40.","status":"published","published":"2020-09-03T13:55:26Z","modified":"2024-08-04T09:25:49Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-03T03:08:00.054795Z"}],"ghsa":[{"id":"GHSA-8qv2-vfh9-c6v7","title":"Rapid7 Nexpose installer version prior to 6.6.40 contains an Unquoted Search Path which may allow...","description":"Rapid7 Nexpose installer version prior to 6.6.40 contains an Unquoted Search Path which may allow an attacker on the local machine to insert an arbitrary file into the executable path. This issue affects: Rapid7 Nexpose versions prior to 6.6.40.","status":"published","published":"2022-05-24T17:27:23Z","modified":"2023-01-29T05:03:44Z","updated_at":"2026-11-02T14:45:23.726919Z"}],"nvd":[{"id":"CVE-2020-7382","description":"Rapid7 Nexpose installer version prior to 6.6.40 contains an Unquoted Search Path which may allow an attacker on the local machine to insert an arbitrary file into the executable path. This issue affects: Rapid7 Nexpose versions prior to 6.6.40.","status":"published","published":"2020-09-03T14:15:11.103Z","modified":"2026-06-17T03:24:47.433Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.4,"vector":"AV:L/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-428"],"updated_at":"2026-11-02T14:06:13.600965Z"}]}}