CVE-2024-0955

Published Feb 7, 2024

Last updated 3 months ago

CVSS medium 4.8

Overview

Description: A stored XSS vulnerability exists where an authenticated, remote attacker with administrator privileges on the Nessus application could alter Nessus proxy settings, which could lead to the execution of remote arbitrary scripts.
Source: vulnreport@tenable.com
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 4.8
Impact score: 2.7
Exploitability score: 1.7
Vector string: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Severity: MEDIUM

Weaknesses

vulnreport@tenable.com: CWE-20
nvd@nist.gov: CWE-79

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:tenable:nessus:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "99E0C9B0-CA4C-4047-A08D-D8434187D1F0",
            "versionEndExcluding": "10.7.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References