漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Code Injection in Rapid7 Nexpose Installer
Vulnerability Description
In Rapid7 Nexpose installer versions prior to 6.6.40, the Nexpose installer calls an executable which can be placed in the appropriate directory by an attacker with access to the local machine. This would prevent the installer from distinguishing between a valid executable called during a Security Console installation and any arbitrary code executable using the same file name.
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Vulnerability Title
Rapid7 Nexpose 代码注入漏洞
Vulnerability Description
Rapid7 Nexpose是美国Rapid7公司的一套能够利用扫描结果深度探测网络的漏洞管理软件。该软件支持扫描配置环境的错误、漏洞、恶意软件等。 Rapid7 Nexpose 6.6.40之前版本中存在安全漏洞，该漏洞源于Nexpose的安装程序可以调用一个可执行文件，攻击者借助该漏洞调用有效可执行文件。
CVSS Information
N/A
Vulnerability Type
N/A