Lucene search

TenableCVE-2024-1891

HistoryJun 12, 2024 - 4:15 p.m.

CVE-2024-1891

2024-06-1216:15:10

CWE-79

tenable

web.nvd.nist.gov

stored cross site scripting

tenable security center

authenticated

remote attacker

web application

scan result page

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

AI Score

Confidence

High

EPSS

Percentile

14.7%

JSON

A stored cross site scripting vulnerability exists in Tenable Security Center where an authenticated, remote attacker could inject HTML code into a web application scan result page.

Affected configurations

Nvd

Node

tenablesecurity_centerRange<6.4.0

VendorProductVersionCPE
tenablesecurity_center*cpe:2.3:a:tenable:security_center:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
tenable	security_center	*	cpe:2.3:a:tenable:security_center::::::::

CNA Affected

[
  {
    "defaultStatus": "affected",
    "product": "Security Center",
    "vendor": "Tenable",
    "versions": [
      {
        "lessThan": "6.4.0",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

www.tenable.com/security/tns-2024-10