CVE-2014-4980

2014-07-2314:55:06

CWE-200

[email protected]

web.nvd.nist.gov

cve-2014-4980

tenable

web ui

vulnerability

remote attackers

sensitive information

token parameter

nvd

nessus

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

6.2 Medium

AI Score

Confidence

Low

0.006 Low

EPSS

Percentile

78.6%

JSON

The /server/properties resource in Tenable Web UI before 2.3.5 for Nessus 5.2.3 through 5.2.7 allows remote attackers to obtain sensitive information via the token parameter.

Affected configurations

NVD

Node

tenablenessusMatch5.2.3

tenablenessusMatch5.2.4

tenablenessusMatch5.2.5

tenablenessusMatch5.2.6

tenablenessusMatch5.2.7

tenableweb_uiRange≤2.3.4

CPENameOperatorVersion
tenable:nessustenable nessuseq5.2.3
tenable:nessustenable nessuseq5.2.4
tenable:nessustenable nessuseq5.2.5
tenable:nessustenable nessuseq5.2.6
tenable:nessustenable nessuseq5.2.7
tenable:web_uitenable web uile2.3.4

CPE	Name	Operator	Version
tenable:nessus	tenable nessus	eq	5.2.3
tenable:nessus	tenable nessus	eq	5.2.4
tenable:nessus	tenable nessus	eq	5.2.5
tenable:nessus	tenable nessus	eq	5.2.6
tenable:nessus	tenable nessus	eq	5.2.7
tenable:web_ui	tenable web ui	le	2.3.4