Remote Code Execution Vulnerability in Tenable.sc by Tenable
CVE-2021-20076

8.8HIGH

Key Information:

Vendor

Tenable

Status
Tenable.sc
Vendor
CVE Published:
3 March 2021

What is CVE-2021-20076?

Certain versions of Tenable.sc, specifically from 5.13.0 to 5.17.0, were found to be vulnerable to a Remote Code Execution (RCE) via insecure unserialization of user inputs. This flaw allows authenticated, unprivileged users to execute arbitrary code on the Tenable.sc server, potentially leading to unauthorized access and system compromise. Organizations using these versions should prioritize updating to secure versions and reviewing server access controls.

Affected Version(s)

Tenable.sc 5.13.0 through 5.17.0

References

https://www.tenable.com/security/tns-2021-03
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.