PT-2022-5413 · Nessus+1 · Nessus

Stefan Pfeil · Published 2022-05-26 · Updated 2025-05-07 · CVE-2022-33757

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nessus (affected versions not specified)

Description The issue is related to insufficient access control in the Nessus web interface, allowing an authenticated attacker to read Nessus Debug Log file attachments without proper privileges. This could lead to the disclosure of information on the scan target and/or the Nessus scan to unauthorized parties who can access the Nessus instance.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

Improper Access Control

Weakness Enumeration

CWE-269

CWE-284

Related Identifiers

BDU:2022-06735

CVE-2022-33757

Affected Products

Nessus

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-33757 · Security Note
• https://osv.dev/vulnerability/CVE-2022-33757 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06735 · Security Note
• https://tenable.com/security/tns-2022-11 · Vendor Advisory
• https://t.me/cvenotify/121196 · Telegram Post