CVE-2018-1141 — Incorrect Permission Assignment in Nessus

CWE-732 — Incorrect Permission Assignment4 documents4 sources
Severity
7.0HIGHNVD
EPSS
0.0%
top 89.22%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Tenable Nessus
Timeline
PublishedMar 20
Latest updateMay 13

Description

When installing Nessus to a directory outside of the default location, Nessus versions prior to 7.0.3 did not enforce secure permissions for sub-directories. This could allow for local privilege escalation if users had not secured the directories in the installation location.

CVSS vector

CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.0 | Impact: 5.9

Affected Packages2 packages

▶NVDtenable/nessus< 7.0.3
▶CVEListV5tenable/nessusAll versions prior to 7.0.3

🔴Vulnerability Details

2
GHSA
GHSA-3pmq-rcw5-rm9v: When installing Nessus to a directory outside of the default location, Nessus versions prior to 7↗2022-05-13
▶
CVEList
CVE-2018-1141: When installing Nessus to a directory outside of the default location, Nessus versions prior to 7↗2018-03-20
▶

💬Community

1
Bugzilla
CVE-2018-20349 igraph: NULL pointer dereference in igraph_i_strdiff function resulting in a denial of service↗2019-01-07
▶
CVE-2018-1141 — Incorrect Permission Assignment | cvebase