CVE-2019-3962

2019-07-0119:39:06

tenable

www.cve.org

4.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

23.5%

JSON

Content Injection vulnerability in Tenable Nessus prior to 8.5.0 may allow an authenticated, local attacker to exploit this vulnerability by convincing another targeted Nessus user to view a malicious URL and use Nessus to send fraudulent messages. Successful exploitation could allow the authenticated adversary to inject arbitrary text into the feed status, which will remain saved post session expiration.

CNA Affected

[
  {
    "product": "Nessus",
    "vendor": "Tenable",
    "versions": [
      {
        "status": "affected",
        "version": "All versions prior to 8.5.0"
      }
    ]
  }
]