CVE-2020-7382: Unquoted Path in Rapid7 Nexpose Installer

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-09-03 · updated 2026-06-17
Weakness: CWE-428

Description

Rapid7 Nexpose installer version prior to 6.6.40 contains an Unquoted Search Path which may allow an attacker on the local machine to insert an arbitrary file into the executable path. This issue affects: Rapid7 Nexpose versions prior to 6.6.40.

Affected products

Rapid7 Nexpose: before 6.6.40 — fixed in 6.6.40

How to fix

Upgrade to a fixed version: Rapid7 Nexpose 6.6.40. Check the vendor advisory for mitigations.

References

https://help.rapid7.com/insightvm/en-us/release-notes/index.html?pid=6.6.40
https://help.rapid7.com/insightvm/en-us/release-notes/index.html?pid=6.6.40

Get alerted when CVE-2020-7382 or the next vulnerability affects your stack