CVE-2022-28291 (GCVE-0-2022-28291)

Vulnerability from cvelistv5 – Published: 2022-10-17 00:00 – Updated: 2025-05-13 19:57
VLAI?
Summary
Insufficiently Protected Credentials: An authenticated user with debug privileges can retrieve stored Nessus policy credentials from the “nessusd” process in cleartext via process dumping. The affected products are all versions of Nessus Essentials and Professional. The vulnerability allows an attacker to access credentials stored in Nessus scanners, potentially compromising its customers’ network of assets.
Severity ?
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE
Assigner
CSW
References
Impacted products
Vendor Product Version
n/a Nessus Professional Affected: Version 10.1.1
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T05:48:38.033Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://cybersecurityworks.com/blog/zero-days/csw-expert-discovers-a-zero-day-vulnerability-in-tenables-nessus-scanner.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-28291",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-13T19:57:13.927333Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-13T19:57:34.629Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Nessus Professional ",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Version 10.1.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Insufficiently Protected Credentials: An authenticated user with debug privileges can retrieve stored Nessus policy credentials from the \u201cnessusd\u201d process in cleartext via process dumping. The affected products are all versions of Nessus Essentials and Professional. The vulnerability allows an attacker to access credentials stored in Nessus scanners, potentially compromising its customers\u2019 network of assets."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-522",
              "description": "CWE-522",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-10-17T00:00:00.000Z",
        "orgId": "ee1bbb37-1770-46bd-bba8-910037954ee0",
        "shortName": "CSW"
      },
      "references": [
        {
          "url": "https://cybersecurityworks.com/blog/zero-days/csw-expert-discovers-a-zero-day-vulnerability-in-tenables-nessus-scanner.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ee1bbb37-1770-46bd-bba8-910037954ee0",
    "assignerShortName": "CSW",
    "cveId": "CVE-2022-28291",
    "datePublished": "2022-10-17T00:00:00.000Z",
    "dateReserved": "2022-03-31T00:00:00.000Z",
    "dateUpdated": "2025-05-13T19:57:34.629Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:tenable:nessus:*:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F88AFAB1-0415-47A6-B1B6-4C845AAFFF82\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Insufficiently Protected Credentials: An authenticated user with debug privileges can retrieve stored Nessus policy credentials from the \\u201cnessusd\\u201d process in cleartext via process dumping. The affected products are all versions of Nessus Essentials and Professional. The vulnerability allows an attacker to access credentials stored in Nessus scanners, potentially compromising its customers\\u2019 network of assets.\"}, {\"lang\": \"es\", \"value\": \"Unas Credenciales Insuficientemente Protegidas: Un usuario autenticado con privilegios de depuraci\\u00f3n puede recuperar las credenciales de las pol\\u00edticas de Nessus almacenadas en el proceso \\\"nessusd\\\" en texto sin cifrar por medio de la descarga del proceso. Los productos afectados son todas las versiones de Nessus Essentials y Professional. La vulnerabilidad permite a un atacante acceder a las credenciales almacenadas en los esc\\u00e1neres Nessus, comprometiendo potencialmente la red de activos de sus clientes\"}]",
      "id": "CVE-2022-28291",
      "lastModified": "2024-11-21T06:57:07.457",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\", \"baseScore\": 6.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 3.6}]}",
      "published": "2022-10-17T16:15:20.930",
      "references": "[{\"url\": \"https://cybersecurityworks.com/blog/zero-days/csw-expert-discovers-a-zero-day-vulnerability-in-tenables-nessus-scanner.html\", \"source\": \"disclose@cybersecurityworks.com\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}, {\"url\": \"https://cybersecurityworks.com/blog/zero-days/csw-expert-discovers-a-zero-day-vulnerability-in-tenables-nessus-scanner.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}]",
      "sourceIdentifier": "disclose@cybersecurityworks.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"disclose@cybersecurityworks.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-522\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-522\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-28291\",\"sourceIdentifier\":\"disclose@cybersecurityworks.com\",\"published\":\"2022-10-17T16:15:20.930\",\"lastModified\":\"2025-05-13T20:15:21.077\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Insufficiently Protected Credentials: An authenticated user with debug privileges can retrieve stored Nessus policy credentials from the \u201cnessusd\u201d process in cleartext via process dumping. The affected products are all versions of Nessus Essentials and Professional. The vulnerability allows an attacker to access credentials stored in Nessus scanners, potentially compromising its customers\u2019 network of assets.\"},{\"lang\":\"es\",\"value\":\"Unas Credenciales Insuficientemente Protegidas: Un usuario autenticado con privilegios de depuraci\u00f3n puede recuperar las credenciales de las pol\u00edticas de Nessus almacenadas en el proceso \\\"nessusd\\\" en texto sin cifrar por medio de la descarga del proceso. Los productos afectados son todas las versiones de Nessus Essentials y Professional. La vulnerabilidad permite a un atacante acceder a las credenciales almacenadas en los esc\u00e1neres Nessus, comprometiendo potencialmente la red de activos de sus clientes\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"disclose@cybersecurityworks.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-522\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-522\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:tenable:nessus:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F88AFAB1-0415-47A6-B1B6-4C845AAFFF82\"}]}]}],\"references\":[{\"url\":\"https://cybersecurityworks.com/blog/zero-days/csw-expert-discovers-a-zero-day-vulnerability-in-tenables-nessus-scanner.html\",\"source\":\"disclose@cybersecurityworks.com\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://cybersecurityworks.com/blog/zero-days/csw-expert-discovers-a-zero-day-vulnerability-in-tenables-nessus-scanner.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://cybersecurityworks.com/blog/zero-days/csw-expert-discovers-a-zero-day-vulnerability-in-tenables-nessus-scanner.html\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T05:48:38.033Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-28291\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-05-13T19:57:13.927333Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-05-13T19:57:30.784Z\"}}], \"cna\": {\"affected\": [{\"vendor\": \"n/a\", \"product\": \"Nessus Professional \", \"versions\": [{\"status\": \"affected\", \"version\": \"Version 10.1.1\"}]}], \"references\": [{\"url\": \"https://cybersecurityworks.com/blog/zero-days/csw-expert-discovers-a-zero-day-vulnerability-in-tenables-nessus-scanner.html\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Insufficiently Protected Credentials: An authenticated user with debug privileges can retrieve stored Nessus policy credentials from the \\u201cnessusd\\u201d process in cleartext via process dumping. The affected products are all versions of Nessus Essentials and Professional. The vulnerability allows an attacker to access credentials stored in Nessus scanners, potentially compromising its customers\\u2019 network of assets.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-522\", \"description\": \"CWE-522\"}]}], \"providerMetadata\": {\"orgId\": \"ee1bbb37-1770-46bd-bba8-910037954ee0\", \"shortName\": \"CSW\", \"dateUpdated\": \"2022-10-17T00:00:00.000Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-28291\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-13T19:57:34.629Z\", \"dateReserved\": \"2022-03-31T00:00:00.000Z\", \"assignerOrgId\": \"ee1bbb37-1770-46bd-bba8-910037954ee0\", \"datePublished\": \"2022-10-17T00:00:00.000Z\", \"assignerShortName\": \"CSW\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.