[R1] Nessus 7.1.0 Fixes Multiple Vulnerabilities

2018-05-1513:59:11

Arnie Cabral

www.tenable.com

608

EPSS

0.001

Percentile

37.0%

JSON

Nessus versions 7.0.3 and earlier have been found vulnerable to two separate issues.

The first vulnerability (XSS) exists due to improper input validation. An authenticated attacker could create and upload a .nessus file, that may be viewed by an administrator allowing for the execution of arbitrary script code in a user’s browser session. In other scenarios, XSS could occur by altering system variables from the Advanced Settings.

CVE-2018-1147 - CVSSv2 (AV:A/AC:H/Au:M/C:P/I:C/A:P/E:POC/RL:OF/RC:C/CDP:L/TD:L/CR:L/IR:L/AR:L)