Skip to content
OpenAdvisories
High WID-SEC-2023-2745 3 CVEs

Tenable Security Nessus Network Monitor: Mehrere Schwachstellen

Published Oct 25, 2023 · Updated Oct 25, 2023 · de-DE

Vendor: Tenable Security Product: Nessus Network Monitor < 6.3.0 Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Tenable Security Nessus Network Monitor ausnutzen, um seine Privilegien zu erhöhen, beliebigen Programmcode mit Administratorrechten auszuführen oder Dateien zu manipulieren.

Product

Tenable Nessus Network Monitor ist eine Lösung zur Inventarisierung und Überwachung von Netzwerkgeräten und den genutzten Protokollen.

Vulnerabilities 3

  • High 7.2
    CVE-2023-5624

    Blind SQL Injection

    Under certain conditions, Nessus Network Monitor was found to not properly enforce input validation. This could allow an admin user to alter parameters that could potentially allow a blindSQL injection.

    Tenable Nessus Network Monitor
  • High 7.1
    CVE-2023-5622

    Privilege Escalation

    Under certain conditions, Nessus Network Monitor could allow a low privileged user to escalate privileges to NT AUTHORITY\SYSTEM on Windows hosts by replacing a specially crafted file.

    Tenable Nessus Network Monitor
  • High 7.0
    CVE-2023-5623

    Privilege Escalation

    NNM failed to properly set ACLs on its installation directory, which could allow a low privileged user to run arbitrary code with SYSTEM privileges where NNM is installed to a non-standard location

    Tenable Nessus Network Monitor

Revision history

  1. #1

    Initiale Fassung

References