CVE-2024-3292 Race Condition

2024-05-1717:17:14

CWE-367

tenable

www.cve.org

race condition

vulnerability

windows nessus agent

arbitrary code

cve-2024-3292

8.2 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

0.0004 Low

EPSS

Percentile

9.0%

JSON

A race condition vulnerability exists where an authenticated, local attacker on a Windows Nessus Agent host could modify installation parameters at installation time, which could lead to the execution of arbitrary code on the Nessus host. - CVE-2024-3292

CNA Affected

[
  {
    "defaultStatus": "affected",
    "platforms": [
      "Windows"
    ],
    "product": "Nessus Agent",
    "vendor": "Tenable",
    "versions": [
      {
        "lessThan": "10.6.4",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]