File Reading Vulnerability in Tenable.io by Tenable
CVE-2022-32974

6.5MEDIUM

Key Information:

Vendor

Tenable

Status
Nessus
Vendor
CVE Published:
21 June 2022

What is CVE-2022-32974?

An improper access control vulnerability exists in Tenable.io that allows an authenticated attacker to read arbitrary files from the underlying operating system. This exploitation occurs through the use of a specially crafted compliance audit file, enabling access without valid SSH credentials, potentially exposing sensitive information.

Affected Version(s)

Nessus Nessus 10.1.X and earlier

References

https://www.tenable.com/security/tns-2022-11
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
The Cyber Security Vulnerability Database.