CVE-2023-3251 Pass-back vulnerability in Nessus

2023-08-2918:38:11

CWE-522

tenable

www.cve.org

pass-back vulnerability

nessus

smtp credentials

4.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

5.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

29.8%

JSON

A pass-back vulnerability exists where an authenticated, remote attacker with administrator privileges could uncover stored SMTP credentials within the Nessus application.This issue affects Nessus: before 10.6.0.

CNA Affected

[
  {
    "defaultStatus": "affected",
    "platforms": [
      "Windows",
      "Linux",
      "MacOS"
    ],
    "product": "Nessus",
    "vendor": "Tenable",
    "versions": [
      {
        "lessThan": "10.6.0",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]