CVE-2023-2005: tenable nessus Uncontrolled Search Path Element

Vulnerability summary

CVE-2023-2005 is a high (CVSS 8.8) Uncontrolled Search Path Element vulnerability in tenable nessus. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 30.3% of scored vulnerabilities.

Timeline

1. 26-06-2023
   PublishedVulnerability first disclosed.
2. 03-12-2024
   Last modifiedVulnerability information updated.

Description

Vulnerability in Tenable Tenable.Io, Tenable Nessus, Tenable Security Center.This issue affects Tenable.Io: before Plugin Feed ID #202306261202 ; Nessus: before Plugin Feed ID #202306261202 ; Security Center: before Plugin Feed ID #202306261202 . This vulnerability could allow a malicious actor with sufficient permissions on a scan target to place a binary in a specific filesystem location, and abuse the impacted plugin in order to escalate privileges.

• CWE-427Uncontrolled Search Path ElementThe product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.