Tenable Nessus Agent
At a glance
- Source
- NVD
- EPSS
- EPSS 0.35 % · percentile 28 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- tenable
- NVD status
- Modified
Description
Nessus Agent versions 7.2.0 through 8.2.2 were found to inadvertently capture the IAM role security token on the local host during initial linking of the Nessus Agent when installed on an Amazon EC2 instance. This could allow a privileged attacker to obtain the token.
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.7 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | HIGH 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2021-7539
- GCVE · GCVE-0-2021-20077
CERT-FR advisories
- CERTFR-2021-AVI-239 — Vulnérabilité dans Tenable Nessus · cert.ssi.gouv.fr
- CERTFR-2021-AVI-208 — Multiples vulnérabilités dans Tenable Nessus Agent · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:tenable:nessus_agent:*:*:*:*:*:*:*:*≥ 7.2.0 < 8.2.3
Affected products
| Product | Versions |
|---|---|
| Tenable Nessus Agent | affected 7.2.0 through 8.2.2 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |