CVE-2023-24494

2023-01-2500:00:00

tenable

www.cve.org

tenable.sc

xss vulnerability

cve-2023-24494

user-supplied input

remote attacker

url

script code

EPSS

0.001

Percentile

29.9%

JSON

A stored cross-site scripting (XSS) vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. An authenticated, remote attacker can exploit this by convincing a user to click a specially crafted URL, to execute arbitrary script code in a user’s browser session.

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "Tenable.sc",
    "versions": [
      {
        "version": "Tenable.sc versions 5.23.1 and earlier",
        "status": "affected"
      }
    ]
  }
]

References

www.tenable.com/security/tns-2023-03

EPSS

0.001

Percentile

29.9%

JSON

Related for CVELIST:CVE-2023-24494