CVE-2024-2390: tenable nessus Improper Privilege Management

Vulnerability summary

CVE-2024-2390 is a high (CVSS 7.8) Improper Privilege Management vulnerability in tenable nessus. EPSS estimates a 0.19% chance of exploitation in the next 30 days, higher than 8.6% of scored vulnerabilities.

Timeline

1. 18-03-2024
   PublishedVulnerability first disclosed.
2. 21-08-2024
   Last modifiedVulnerability information updated.

Description

As a part of Tenable’s vulnerability disclosure program, a vulnerability in a Nessus plugin was identified and reported. This vulnerability could allow a malicious actor with sufficient permissions on a scan target to place a binary in a specific filesystem location, and abuse the impacted plugin in order to escalate privileges.

• CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.