An authenticated attacker could utilize the identical agent and cluster node linking keys to potentially allow for a scenario where unauthorized disclosure of agent logs and data is present.

According to its self-reported version, the Tenable Nessus application running on the remote host is 10.x prior to 10.4.0. It is, therefore, affected by multiple vulnerabilities, including:

  - An authenticated attacker could utilize the identical agent and cluster node linking keys to potentially allow for a     scenario where unauthorized disclosure of agent logs and data is present. (CVE-2022-3499)   
  - An authenticated attacker could modify the client-side behavior to bypass the protection mechanisms resulting in     potentially unexpected interactions between the client and server. (CVE-2022-3498)

  - Cross-site scripting in the checkboxradio widget in JQuery UI. (CVE-2022-31160)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

Detections

Analytics

CVE-2022-3499

medium

Tenable Plugins

medium