XSS in Tenable Nessus
CVE-2019-3962
Content Injection vulnerability in Tenable Nessus prior to 8.5.0 may allow an authenticated, local attacker to exploit this vulnerability by convincing another targeted Nessus user to view a malicious URL and use Nessus to send fraudulent messages. Successful exploitation could allow the authenticated adversary to inject arbitrary text into the feed status, which will remain saved post session expiration.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.010 (57.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 3.3 (Low). Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N.
Affected products
- Tenable Nessus — versions All versions prior to 8.5.0
Weakness classification (CWE)
References
- vulnreport@tenable.com (x_refsource_CONFIRM, Vendor Advisory)
- vulnreport@tenable.com (Third Party Advisory, vdb-entry, x_refsource_BID)
Frequently asked questions
- What is CVE-2019-3962?
- CVE-2019-3962 is a low-severity vulnerability in Tenable Nessus, classified under Cross-site Scripting. CVSS score: 3.3/10. Published 2019-07-01.
- How severe is CVE-2019-3962?
- Low severity. CVSS v3 base score is 3.3 out of 10.