CVE-2024-0955

Published Feb 7, 2024

Last updated 9 months ago

Overview

Description: A stored XSS vulnerability exists where an authenticated, remote attacker with administrator privileges on the Nessus application could alter Nessus proxy settings, which could lead to the execution of remote arbitrary scripts.
Source: vulnreport@tenable.com
NVD status: Analyzed

Hype score: Not currently trending

Risk scores

CVSS 3.1

Type: Primary
Base score: 4.8
Impact score: 2.7
Exploitability score: 1.7
Vector string: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Severity: MEDIUM

Weaknesses

nvd@nist.gov: CWE-79
vulnreport@tenable.com: CWE-20

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:tenable:nessus:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "99E0C9B0-CA4C-4047-A08D-D8434187D1F0",
            "versionEndExcluding": "10.7.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References