As part of our Security Development Lifecycle, a potential privilege escalation issue was identified internally. This could allow a malicious actor with sufficient permissions to modify environment variables and abuse an impacted plugin in order to escalate privileges. We have resolved the issue and also made several defense-in-depth fixes alongside. While the probability of successful exploitation is low, Tenable is committed to securing our customers’ environments and our products. The updates have been distributed via the Tenable plugin feed in feed serial numbers equal to or greater than #202212212055.
References
| Link | Resource |
|---|---|
| https://www.tenable.com/security/tns-2023-04 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
07 Feb 2023, 22:43
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | NVD-CWE-noinfo | |
| References | (MISC) https://www.tenable.com/security/tns-2023-04 - Vendor Advisory | |
| First Time |
Tenable tenable.sc
Tenable Tenable nessus Tenable tenable.io |
|
| CPE | cpe:2.3:a:tenable:tenable.sc:-:*:*:*:*:*:*:* cpe:2.3:a:tenable:nessus:-:*:*:*:*:*:*:* cpe:2.3:a:tenable:tenable.io:-:*:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
01 Feb 2023, 03:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-02-01 03:15
Updated : 2023-12-10 14:48
NVD link : CVE-2023-0524
Mitre link : CVE-2023-0524
CVE.ORG link : CVE-2023-0524
JSON object : View
Products Affected
tenable
- tenable.io
- tenable.sc
- nessus
CWE