Medium severity · published Sep 18, 2020
CVE-2020-7358
In AppSpider installer versions prior to 7.2.126, the AppSpider installer calls an executable which can be placed in the appropriate directory by an attacker with access to the…
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
In AppSpider installer versions prior to 7.2.126, the AppSpider installer calls an executable which can be placed in the appropriate directory by an attacker with access to the local machine. This would prevent the installer from distinguishing between a valid executable called during an installation and any arbitrary code executable using the same file name.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AP
Appspider · Rapid7
before 7.2.126 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-7358
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-7358
Release Notes
https://help.rapid7.com/appspider/release-notes/index.html?pid=7.2.126
More from Appspider
7.1
CVE-2019-5647
The Chrome Plugin for Rapid7 AppSpider can incorrectly keep browser sessions active after recording a macro, even after a restart of the Chrome browser