Tenable Nessus up to 8.4.x URL Code Injection privilege escalation

A vulnerability was found in Tenable Nessus up to 8.4.x (Security Testing Software). It has been rated as critical. Affected by this issue is some unknown processing of the component URL Handler. The manipulation with an unknown input leads to a privilege escalation vulnerability (Code Injection). Using CWE to declare the problem leads to CWE-94. Impacted is confidentiality, integrity, and availability.

The weakness was published 07/01/2019. The advisory is available at tenable.com. This vulnerability is handled as CVE-2019-3962 since 01/03/2019. Local access is required to approach this attack. The successful exploitation requires a single authentication. The technical details are unknown and an exploit is not available.

Upgrading to version 8.5.0 eliminates this vulnerability.

Similar entry is available at 136889.

Type

• Security Testing Software

Vendor

• Tenable

Name

• Nessus

• 🔒

• 🔒

VulDB Meta Base Score: 4.8
VulDB Meta Temp Score: 4.6

VulDB Base Score: 4.8
VulDB Temp Score: 4.6
VulDB Vector: 🔒
VulDB Reliability: 🔍

VulDB Base Score: 🔒
VulDB Temp Score: 🔒
VulDB Reliability: 🔍
Class: Privilege escalation / Code Injection (CWE-94)
Local: Yes
Remote: No

Availability: 🔒
Status: Not defined

Price Prediction: 🔍
Current Price Estimation: 🔒

Threat Intelligenceinfoedit

Threat: 🔍
Adversaries: 🔍
Geopolitics: 🔍
Economy: 🔍
Predictions: 🔍
Remediation: 🔍Recommended: Upgrade
Status: 🔍

0-Day Time: 🔒

Upgrade: Nessus 8.5.0

01/03/2019 CVE assigned
07/01/2019 +179 days Advisory disclosed
07/02/2019 +1 days VulDB entry created
07/02/2019 +0 days VulDB last updateAdvisory: tenable.com

CVE: CVE-2019-3962 (🔒)
scip Labs: https://www.scip.ch/en/?labs.20091204
See also: 🔒

Created: 07/02/2019 06:43 AM
Complete: 🔍

Comments

Comments are closed.