CVE-2024-3290 - Race Condition

Back Back to CVE browser

HIGH

Race Condition

Published May 17, 2024

8.2

HIGH

CVSS 3.1

EPSS 0.18%

Description

A race condition vulnerability exists where an authenticated, local attacker on a Windows Nessus host could modify installation parameters at installation time, which could lead to the execution of arbitrary code on the Nessus host

Affected products

Vendor Tenable Product Nessus Default
affected
- Version
  0
  Status
  affected
  Constraints
  <10.7.3

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Tenable

Nessus

affected

Version	Status	Constraints
0	affected	<10.7.3

Vendor Tenable Product Nessus Default
n/a
- Version
  -
  Status
  affected
  Constraints
  <=10.7.2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Tenable

Nessus

n/a

Version	Status	Constraints
-	affected	<=10.7.2

Remediation

Vendor solution

Tenable has released Nessus 10.7.3 to address these issues. The installation files can be obtained from the Tenable Downloads Portal ( https://www.tenable.com/downloads/nessus ).

Weaknesses (1)

CWE-367