Nessus Agent vulnerabilities
10 known vulnerabilities in Nessus Agent from Tenable. 10 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.1 Critical severity
tenable_agent: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability in Tenable Agent 11.2.0 and 11.1.3 and lower allows a privileged attacker to write arbitrary files outside the intended plugin directory, potentially leading to remote code execution.
- 7.8 High severity
Tenable Nessus, Tenable Nessus Agent: Improper Link Resolution Before File Access
This vulnerability allows an attacker to create a junction, enabling the deletion of arbitrary files with SYSTEM privileges. As a result, this condition potentially facilitates arbitrary code execution, whereby an attacker may exploit the vulnerability to exec
- 8.8 High severity
Nessus Agent: Improper Privilege Management
A vulnerability has been identified in the installation/uninstallation of the Nessus Agent Tray App on Windows Hosts which could lead to escalation of privileges.
- 7.8 High severity
Agent: Improper Privilege Management
In Tenable Agent versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could arbitrarily delete local system files with SYSTEM privilege, potentially leading to local privilege escalation.
- 7.8 High severity
Agent: Improper Privilege Management
In Tenable Agent versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could overwrite arbitrary local system files with log content at SYSTEM privilege.
- 7.8 High severity
Nessus Agent: Incorrect Default Permissions
When installing Nessus Agent to a non-default location on a Windows host, Nessus Agent versions prior to 10.8.3 did not enforce secure permissions for sub-directories. This could allow for local privilege escalation if users had not secured the directories in
- 8.2 High severity
Nessus Agent: Time-of-check Time-of-use (TOCTOU) Race Condition
A race condition vulnerability exists where an authenticated, local attacker on a Windows Nessus Agent host could modify installation parameters at installation time, which could lead to the execution of arbitrary code on the Nessus host. - CVE-2024-3292
- 7.8 High severity
Nessus Agent: Improper Preservation of Permissions
When installing Nessus Agent to a directory outside of the default location on a Windows host, Nessus Agent versions prior to 10.6.4 did not enforce secure permissions for sub-directories. This could allow for local privilege escalation if users had not secure
- 7.8 High severity
Nessus Agent: Improper Privilege Management
As a part of Tenable’s vulnerability disclosure program, a vulnerability in a Nessus plugin was identified and reported. This vulnerability could allow a malicious actor with sufficient permissions on a scan target to place a binary in a specific filesystem lo
- 7.3 High severity
Nessus: Improper Privilege Management
Under certain conditions, a low privileged attacker could load a specially crafted file during installation or upgrade to escalate privileges on Windows and Linux hosts.