CVE-2022-0130 — Code Injection in Tenable.sc

CWE-94 — Code InjectionCWE-22 — Path Traversal4 documents4 sources
Severity
8.1HIGHNVD
CISA7.5
EPSS
1.9%
top 16.53%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Tenable Tenable.sc
Timeline
PublishedJan 14
Latest updateMar 25

Description

Tenable.sc versions 5.14.0 through 5.19.1 were found to contain a remote code execution vulnerability which could allow a remote, unauthenticated attacker to execute code under special circumstances. An attacker would first have to stage a specific file type in the web server root of the Tenable.sc host prior to remote exploitation.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.2 | Impact: 5.9

Affected Packages2 packages

▶NVDtenable/tenable.sc5.14.0 — 5.19.1
▶CVEListV5tenable/tenable.sc5.14.0 through 5.19.1

🔴Vulnerability Details

2
GHSA
GHSA-wrgg-vhm7-9frx: Tenable↗2022-01-15
▶
CVEList
CVE-2022-0130: Tenable↗2022-01-14
▶

📋Vendor Advisories

1
CISA
Ruby on Rails Directory Traversal Vulnerability↗2022-03-25
▶
CVE-2022-0130 — Code Injection in Tenable Tenable.sc | cvebase