PT-2020-18715 · Tenable · Nessus Network Monitor

Published 2020-11-06 · Updated 2021-09-09 · CVE-2020-5794

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nessus Network Monitor versions 5.11.0, 5.11.1, and 5.12.0

Description A vulnerability in Nessus Network Monitor could allow an authenticated local attacker to execute arbitrary code by copying user-supplied files to a specially constructed path in a specifically named user directory. The attacker needs valid credentials on the Windows system to exploit this issue.

Recommendations For versions 5.11.0, 5.11.1, and 5.12.0, consider restricting access to the user directory where the vulnerability can be exploited until a patch is available. As a temporary workaround, avoid using the specially constructed path in the user directory to minimize the risk of exploitation. Restrict access to the Windows system to only necessary personnel to reduce the attack surface.

Fix

Related Identifiers

CVE-2020-5794

Affected Products

Nessus Network Monitor

References · 7

• https://osv.dev/vulnerability/CVE-2020-5794 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5794 · Security Note
• https://t.me/cibsecurity/15992 · Telegram Post
• https://t.me/cvenotify/5728 · Telegram Post
• https://t.me/cvenotify/19719 · Telegram Post
• https://tenable.com/security/tns-2020-09 · Note
• https://t.me/cvenotify/5269 · Telegram Post