CVE-2022-28291

Insufficiently Protected Credentials: An authenticated user with debug privileges can retrieve stored Nessus policy credentials from the “nessusd” process in cleartext via process dumping. The affected products are all versions of Nessus Essentials and Professional. The vulnerability allows an attacker to access credentials stored in Nessus scanners, potentially compromising its customers’ network of assets.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://cybersecurityworks.com/blog/zero-days/csw-expert-discovers-a-zero-day-vulnerability-in-tenables-nessus-scanner.html	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:tenable:nessus:*:*:*:*:*:*:*:*

History

19 Oct 2022, 13:34

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 6.5
CWE		CWE-522
CPE		cpe:2.3:a:tenable:nessus::::::::
First Time		Tenable Tenable nessus
References	~~(MISC) https://cybersecurityworks.com/blog/zero-days/csw-expert-discovers-a-zero-day-vulnerability-in-tenables-nessus-scanner.html -~~	(MISC) https://cybersecurityworks.com/blog/zero-days/csw-expert-discovers-a-zero-day-vulnerability-in-tenables-nessus-scanner.html - Exploit, Third Party Advisory

17 Oct 2022, 17:56

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-10-17 16:15

Updated : 2023-12-10 14:35

NVD link : CVE-2022-28291

Mitre link : CVE-2022-28291

CVE.ORG link : CVE-2022-28291

JSON object : View

Products Affected

tenable

nessus

CWE

CWE-522

Insufficiently Protected Credentials

{"id": "CVE-2022-28291", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2022-10-17T16:15:20.930", "references": [{"url": "https://cybersecurityworks.com/blog/zero-days/csw-expert-discovers-a-zero-day-vulnerability-in-tenables-nessus-scanner.html", "tags": ["Exploit", "Third Party Advisory"], "source": "disclose@cybersecurityworks.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-522"}]}, {"type": "Secondary", "source": "disclose@cybersecurityworks.com", "description": [{"lang": "en", "value": "CWE-522"}]}], "descriptions": [{"lang": "en", "value": "Insufficiently Protected Credentials: An authenticated user with debug privileges can retrieve stored Nessus policy credentials from the \u201cnessusd\u201d process in cleartext via process dumping. The affected products are all versions of Nessus Essentials and Professional. The vulnerability allows an attacker to access credentials stored in Nessus scanners, potentially compromising its customers\u2019 network of assets."}, {"lang": "es", "value": "Unas Credenciales Insuficientemente Protegidas: Un usuario autenticado con privilegios de depuraci\u00f3n puede recuperar las credenciales de las pol\u00edticas de Nessus almacenadas en el proceso \"nessusd\" en texto sin cifrar por medio de la descarga del proceso. Los productos afectados son todas las versiones de Nessus Essentials y Professional. La vulnerabilidad permite a un atacante acceder a las credenciales almacenadas en los esc\u00e1neres Nessus, comprometiendo potencialmente la red de activos de sus clientes"}], "lastModified": "2022-10-19T13:34:24.947", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tenable:nessus:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F88AFAB1-0415-47A6-B1B6-4C845AAFFF82"}], "operator": "OR"}]}], "sourceIdentifier": "disclose@cybersecurityworks.com"}