cve-2019-3923
Vulnerability from cvelistv5
Published
2019-02-12 04:00
Modified
2024-09-17 02:10
Severity ?
Summary
Nessus versions 8.2.1 and earlier were found to contain a stored XSS vulnerability due to improper validation of user-supplied input. An authenticated, remote attacker could potentially exploit this vulnerability via a specially crafted request to execute arbitrary script code in a user's browser session. Tenable has released Nessus 8.2.2 to address this issue.
References
vulnreport@tenable.comhttps://www.tenable.com/security/tns-2019-01Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.tenable.com/security/tns-2019-01Vendor Advisory
Impacted products
Vendor Product Version
Tenable Tenable Nessus Version: All versions prior to 8.2.2
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T19:26:27.435Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://www.tenable.com/security/tns-2019-01",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "Tenable Nessus",
               vendor: "Tenable",
               versions: [
                  {
                     status: "affected",
                     version: "All versions prior to 8.2.2",
                  },
               ],
            },
         ],
         datePublic: "2019-01-29T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "Nessus versions 8.2.1 and earlier were found to contain a stored XSS vulnerability due to improper validation of user-supplied input. An authenticated, remote attacker could potentially exploit this vulnerability via a specially crafted request to execute arbitrary script code in a user's browser session. Tenable has released Nessus 8.2.2 to address this issue.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Local Privilege Escalation",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2019-02-12T03:57:01",
            orgId: "5ac1ecc2-367a-4d16-a0b2-35d495ddd0be",
            shortName: "tenable",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://www.tenable.com/security/tns-2019-01",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "vulnreport@tenable.com",
               DATE_PUBLIC: "2019-01-29T00:00:00",
               ID: "CVE-2019-3923",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "Tenable Nessus",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "All versions prior to 8.2.2",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Tenable",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Nessus versions 8.2.1 and earlier were found to contain a stored XSS vulnerability due to improper validation of user-supplied input. An authenticated, remote attacker could potentially exploit this vulnerability via a specially crafted request to execute arbitrary script code in a user's browser session. Tenable has released Nessus 8.2.2 to address this issue.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Local Privilege Escalation",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://www.tenable.com/security/tns-2019-01",
                     refsource: "CONFIRM",
                     url: "https://www.tenable.com/security/tns-2019-01",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "5ac1ecc2-367a-4d16-a0b2-35d495ddd0be",
      assignerShortName: "tenable",
      cveId: "CVE-2019-3923",
      datePublished: "2019-02-12T04:00:00Z",
      dateReserved: "2019-01-03T00:00:00",
      dateUpdated: "2024-09-17T02:10:57.993Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      fkie_nvd: {
         configurations: "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:tenable:nessus:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"8.2.1\", \"matchCriteriaId\": \"788872E9-0FD3-433B-A349-4087766F8CBB\"}]}]}]",
         descriptions: "[{\"lang\": \"en\", \"value\": \"Nessus versions 8.2.1 and earlier were found to contain a stored XSS vulnerability due to improper validation of user-supplied input. An authenticated, remote attacker could potentially exploit this vulnerability via a specially crafted request to execute arbitrary script code in a user's browser session. Tenable has released Nessus 8.2.2 to address this issue.\"}, {\"lang\": \"es\", \"value\": \"Nessus, en versiones 8.2.1 y anteriores, conten\\u00eda una vulnerabilidad Cross-Site Scripting (XSS) persistente debido a la validaci\\u00f3n incorrecta de entradas proporcionadas por el usuario. Un atacante remoto autenticado podr\\u00eda explotar esta vulnerabilidad mediante una petici\\u00f3n especialmente manipulada para ejecutar c\\u00f3digo script arbitrario en la sesi\\u00f3n de navegaci\\u00f3n de un usuario. Tenable ha lanzado la versi\\u00f3n 8.2.2 de Nessus para abordar este problema.\"}]",
         id: "CVE-2019-3923",
         lastModified: "2024-11-21T04:42:52.330",
         metrics: "{\"cvssMetricV30\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.0\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\", \"baseScore\": 5.4, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.3, \"impactScore\": 2.7}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:S/C:N/I:P/A:N\", \"baseScore\": 3.5, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"SINGLE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"LOW\", \"exploitabilityScore\": 6.8, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": true}]}",
         published: "2019-02-12T04:29:00.690",
         references: "[{\"url\": \"https://www.tenable.com/security/tns-2019-01\", \"source\": \"vulnreport@tenable.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://www.tenable.com/security/tns-2019-01\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
         sourceIdentifier: "vulnreport@tenable.com",
         vulnStatus: "Modified",
         weaknesses: "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-79\"}]}]",
      },
      nvd: "{\"cve\":{\"id\":\"CVE-2019-3923\",\"sourceIdentifier\":\"vulnreport@tenable.com\",\"published\":\"2019-02-12T04:29:00.690\",\"lastModified\":\"2024-11-21T04:42:52.330\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Nessus versions 8.2.1 and earlier were found to contain a stored XSS vulnerability due to improper validation of user-supplied input. An authenticated, remote attacker could potentially exploit this vulnerability via a specially crafted request to execute arbitrary script code in a user's browser session. Tenable has released Nessus 8.2.2 to address this issue.\"},{\"lang\":\"es\",\"value\":\"Nessus, en versiones 8.2.1 y anteriores, contenía una vulnerabilidad Cross-Site Scripting (XSS) persistente debido a la validación incorrecta de entradas proporcionadas por el usuario. Un atacante remoto autenticado podría explotar esta vulnerabilidad mediante una petición especialmente manipulada para ejecutar código script arbitrario en la sesión de navegación de un usuario. Tenable ha lanzado la versión 8.2.2 de Nessus para abordar este problema.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":5.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.3,\"impactScore\":2.7}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:S/C:N/I:P/A:N\",\"baseScore\":3.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":6.8,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:tenable:nessus:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"8.2.1\",\"matchCriteriaId\":\"788872E9-0FD3-433B-A349-4087766F8CBB\"}]}]}],\"references\":[{\"url\":\"https://www.tenable.com/security/tns-2019-01\",\"source\":\"vulnreport@tenable.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.tenable.com/security/tns-2019-01\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}",
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.