Tenable Nessus Agent
En bref
- Source
- NVD
- EPSS
- EPSS 0.35 % · centile 28 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- tenable
- Statut NVD
- Modified
Description
Nessus Agent versions 7.2.0 through 8.2.2 were found to inadvertently capture the IAM role security token on the local host during initial linking of the Nessus Agent when installed on an Amazon EC2 instance. This could allow a privileged attacker to obtain the token.
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.7 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | HIGH 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2021-7539
- GCVE · GCVE-0-2021-20077
Avis du CERT-FR
- CERTFR-2021-AVI-239 — Vulnérabilité dans Tenable Nessus · cert.ssi.gouv.fr
- CERTFR-2021-AVI-208 — Multiples vulnérabilités dans Tenable Nessus Agent · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:tenable:nessus_agent:*:*:*:*:*:*:*:*≥ 7.2.0 < 8.2.3
Produits affectés
| Produit | Versions |
|---|---|
| Tenable Nessus Agent | affected 7.2.0 through 8.2.2 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |