PT-2024-24942 · Nessus · Nessus

Alaa Kachouh + 1 · Published 2024-05-17 · Updated 2024-05-17 · CVE-2024-3289

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nessus versions prior to 10.7.3

Description The issue arises when Nessus is installed to a non-default directory on a Windows host, where it fails to enforce secure permissions for sub-directories. This could potentially allow for local privilege escalation if the directories in the non-default installation location are not properly secured by the users.

Recommendations For Nessus versions prior to 10.7.3, update to version 10.7.3 or later to resolve the issue.

Fix

Improper Preservation of Permissions

Weakness Enumeration

CWE-281

Related Identifiers

CVE-2024-3289

Affected Products

Nessus

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2024-3289 · Security Note
• https://tenable.com/security/tns-2024-08 · Note