Tenable Nessus < 8.2.2 Stored XSS Vulnerability (TNS-2019-01)

medium Nessus Plugin ID 121620

Language:

Synopsis

Tenable Nessus running on the remote host is affected by a stored cross-site scripting vulnerability.

Description

According to its self-reported version, the Tenable Nessus application running on the remote host is prior to 8.2.2. It is, therefore, affected by:

 - A stored cross-site scripting (XSS) vulnerability exists due to improper validation of user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit this vulnerability via a specially crafted request, to execute arbitrary script code in a user's browser session.

Solution

Upgrade to Tenable Nessus version 8.2.2 or later.

See Also

https://www.tenable.com/security/tns-2019-01

Plugin Details

Severity: Medium

ID: 121620

File Name: nessus_tns_2019_01.nasl

Version: 1.5

Type: remote

Family: Misc.

Published: 2/6/2019

Updated: 4/11/2022

Configuration: Enable thorough checks

Risk Information

VPR

Risk Factor: Low

Score: 3

CVSS v2

Risk Factor: Low

Base Score: 3.5

Temporal Score: 2.6

Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N

Temporal Vector: E:U/RL:OF/RC:C

CVSS Score Source: CVE-2019-3923

CVSS v3

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:tenable:nessus

Required KB Items: installed_sw/nessus

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2/1/2019

Vulnerability Publication Date: 2/1/2019

Reference Information

CVE: CVE-2019-3923

EDB-ID: 46315