CVE-2024-3291: tenable nessus_agent Improper Preservation of Permissions

Vulnerability summary

CVE-2024-3291 is a high (CVSS 7.8) Improper Preservation of Permissions vulnerability in tenable nessus_agent. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 6.4% of scored vulnerabilities.

Timeline

1. 17-05-2024
   PublishedVulnerability first disclosed.
2. 01-08-2024
   Last modifiedVulnerability information updated.

Description

When installing Nessus Agent to a directory outside of the default location on a Windows host, Nessus Agent versions prior to 10.6.4 did not enforce secure permissions for sub-directories. This could allow for local privilege escalation if users had not secured the directories in the non-default installation location.

• CWE-281Improper Preservation of PermissionsThe product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.