|
[Japanese]
|
JVNDB-2017-000082
|
Nessus vulnerable to cross-site scripting
|
|
Nessus provided by Tenable Network Security, Inc. contains a stored cross-site scripting vulnerability (CWE-79) (CVE-2017-2122).
An authenticated user may store crafted contents to Nessus.
According to the developer, another stored cross-site scripting vulnerability (CVE-2017-5179) was found and fixed in Nessus 6.9.3 as well as the issue of CVE-2017-2122.
For more information, please see the developer's advisory.
Toshitsugu Yoneyama of Mitsui Bussan Secure Directions, Inc. reported this vulnerability (CVE-2017-2122) to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
|
|
CVSS V3 Severity:
Base Metrics 5.4 (Medium) [IPA Score]
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: Required
- Scope: Changed
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
CVSS V2 Severity:
Base Metrics 4.0 (Medium) [IPA Score]
- Access Vector: Network
- Access Complexity: Low
- Authentication: Single Instance
- Confidentiality Impact: None
- Integrity Impact: Partial
- Availability Impact: None
|
|
|
Tenable Network Security
- Nessus 6.8.0, 6.8.1, 6.9.0, 6.9.1, 6.9.2
|
|
|
An arbitrary JavaScript may be executed on the logged in user's web browser.
|
|
[Update the Software]
Update to the latest version according to the information provided by the developer.
|
|
Tenable Network Security
|
|
- Cross-site Scripting(CWE-79) [IPA Evaluation]
|
|
- CVE-2017-2122
|
|
- JVN : JVN#87760109
- National Vulnerability Database (NVD) : CVE-2017-2122
|
|
- [2017/05/09]
Web page was published
[2017/11/27]
References : Content was added
|
