Command injection

2017-04-2118:59:00

PRIOn knowledge base

www.prio-n.com

9.4 High

AI Score

Confidence

High

0.039 Low

EPSS

Percentile

92.0%

JSON

Tenable Appliance 3.5 - 4.4.0, and possibly prior versions, contains a flaw in the simpleupload.py script in the Web UI. Through the manipulation of the tns_appliance_session_user parameter, a remote attacker can inject arbitrary commands.

CPENameOperatorVersion
applianceeq4.3.0
applianceeq3.4.0
applianceeq4.3.1
applianceeq4.0.0
applianceeq3.5.0
applianceeq4.4.0
applianceeq3.10.1
applianceeq4.2.0
applianceeq3.5.1
applianceeq4.1.0

Name	Operator	Version
appliance	eq	4.3.0
appliance	eq	3.4.0
appliance	eq	4.3.1
appliance	eq	4.0.0
appliance	eq	3.5.0
appliance	eq	4.4.0
appliance	eq	3.10.1
appliance	eq	4.2.0
appliance	eq	3.5.1
appliance	eq	4.1.0