CVE-2022-0130

Tenable.sc versions 5.14.0 through 5.19.1 were found to contain a remote code execution vulnerability which could allow a remote, unauthenticated attacker to execute code under special circumstances. An attacker would first have to stage a specific file type in the web server root of the Tenable.sc host prior to remote exploitation.

CVSS v3 8.1 HIGH
CVSS v2.0 6.8 MEDIUM

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://www.tenable.com/security/tns-2022-01	Vendor Advisory
https://www.tenable.com/security/tns-2022-01	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:*

History

21 Nov 2024, 06:37

Type	Values Removed	Values Added
References	~~() https://www.tenable.com/security/tns-2022-01 - Vendor Advisory~~	() https://www.tenable.com/security/tns-2022-01 - Vendor Advisory

08 Aug 2023, 14:22

Type	Values Removed	Values Added
CWE	~~CWE-94~~	NVD-CWE-noinfo

Information

Published : 2022-01-14 20:15

Updated : 2024-11-21 06:37

NVD link : CVE-2022-0130

Mitre link : CVE-2022-0130

CVE.ORG link : CVE-2022-0130

JSON object : View

Products Affected

tenable

tenable.sc

CWE

NVD-CWE-noinfo

{"id": "CVE-2022-0130", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}]}, "published": "2022-01-14T20:15:15.640", "references": [{"url": "https://www.tenable.com/security/tns-2022-01", "tags": ["Vendor Advisory"], "source": "vulnreport@tenable.com"}, {"url": "https://www.tenable.com/security/tns-2022-01", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Tenable.sc versions 5.14.0 through 5.19.1 were found to contain a remote code execution vulnerability which could allow a remote, unauthenticated attacker to execute code under special circumstances. An attacker would first have to stage a specific file type in the web server root of the Tenable.sc host prior to remote exploitation."}, {"lang": "es", "value": "Se ha detectado que Tenable.sc versiones 5.14.0 a 5.19.1, contienen una vulnerabilidad de ejecuci\u00f3n de c\u00f3digo remota que podr\u00eda permitir a un atacante remoto no autenticado ejecutar c\u00f3digo en circunstancias especiales. Un atacante tendr\u00eda que escenificar primero un tipo de archivo espec\u00edfico en el root del servidor web del host de Tenable.sc antes de la explotaci\u00f3n remota"}], "lastModified": "2024-11-21T06:37:57.923", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "494A137C-A8B9-4E02-9324-BD76C8EE83CF", "versionEndIncluding": "5.19.1", "versionStartIncluding": "5.14.0"}], "operator": "OR"}]}], "sourceIdentifier": "vulnreport@tenable.com"}