Is CVE-2020-7381 being actively exploited?

CVE-2020-7381 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

What is the CVSS score for CVE-2020-7381?

CVE-2020-7381 has a CVSS 3.1 base score of 5.8 (MEDIUM).

CVE-2020-7381

MEDIUM · CVSS 5.8EPSS 0.7%EU EUVD

In Rapid7 Nexpose installer versions prior to 6.6.40, the Nexpose installer calls an executable which can be placed in the appropriate directory by an attacker with access to the local machine. This would prevent the installer from distinguishing between a valid executable called during a Security Console installation and any arbitrary code executable using the same file name.

Key facts

CVSS score: 5.8 (v3.1)
Severity: MEDIUM
CVSS vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L
Weakness (CWE): CWE-94
EPSS score: 0.7% (51th percentile)
In CISA KEV: No
In EU EUVD: Yes (EUVD-2020-28508)
Published: September 3, 2020
NVD last modified: June 17, 2026
Status: Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2020-28508 in the EU Vulnerability Database. Last updated in EUVD on August 4, 2024.

View on the EU Vulnerability Database

Affected products

rapid7 / nexpose

Certified products that may be affected

1 FIPS 140 or Common Criteria certified product, from automated matching by sec-certs.org.

Rapid7™ Nexpose™ Vulnerability Management and Penetration Testing System V5.1 - Rapid7 LLC - Common Criteria 383-4-148 - archived

References

https://help.rapid7.com/insightvm/en-us/release-notes/index.html?pid=6.6.40(Release Notes, Vendor Advisory)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain