CVE-2020-7382: 
Nexpose vulnerability analysis and mitigation

Rapid7 Nexpose installer versions prior to 6.6.40 contained an Unquoted Search Path vulnerability (CVE-2020-7382). This security flaw was discovered and disclosed in September 2020, affecting the installation process of the Nexpose vulnerability management solution (NVD).

The vulnerability is classified as an Unquoted Search Path vulnerability (CWE-428). It has a local attack vector with high attack complexity, as indicated by the CVSS scoring parameters (NVD Status).

The vulnerability could potentially allow an attacker with local machine access to execute arbitrary code by exploiting the unquoted service path during the installation process (NVD).

The vulnerability requires local access to the affected system to be exploited. An attacker would need to be physically present or have existing access to the target machine to attempt exploitation (NVD Status).

The vulnerability was addressed in Rapid7 Nexpose installer version 6.6.40. Users should upgrade to this version or later to mitigate the vulnerability (NVD).