CVE-2021-20077 — Incorrect Permission Assignment in Nessus Agent

CWE-732 — Incorrect Permission Assignment3 documents3 sources
Severity
6.7MEDIUMNVD
EPSS
0.0%
top 87.26%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Tenable Nessus Agent
Timeline
PublishedMar 19
Latest updateMay 24

Description

Nessus Agent versions 7.2.0 through 8.2.2 were found to inadvertently capture the IAM role security token on the local host during initial linking of the Nessus Agent when installed on an Amazon EC2 instance. This could allow a privileged attacker to obtain the token.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 0.8 | Impact: 5.9

Affected Packages1 packages

▶NVDtenable/nessus_agent7.2.0 — 8.2.3

Patches

Patch: www.tenable.com ↗Patch: www.tenable.com ↗Patch: www.tenable.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-fh62-2wf5-r836: Nessus Agent versions 7↗2022-05-24
▶
CVEList
CVE-2021-20077: Nessus Agent versions 7↗2021-03-19
▶
CVE-2021-20077 — Incorrect Permission Assignment | cvebase