{"containers": {"cna": {"affected": [{"product": "Tenable Nessus Agent", "vendor": "n/a", "versions": [{"status": "affected", "version": "7.2.0 through 8.2.2"}]}], "descriptions": [{"lang": "en", "value": "Nessus Agent versions 7.2.0 through 8.2.2 were found to inadvertently capture the IAM role security token on the local host during initial linking of the Nessus Agent when installed on an Amazon EC2 instance. This could allow a privileged attacker to obtain the token."}], "problemTypes": [{"descriptions": [{"description": "Privilege Escalation", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2022-09-23T13:48:31", "orgId": "5ac1ecc2-367a-4d16-a0b2-35d495ddd0be", "shortName": "tenable"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.tenable.com/security/tns-2021-04-0"}, {"tags": ["x_refsource_MISC"], "url": "https://www.tenable.com/security/tns-2021-07"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.tenable.com/security/tns-2021-04-0"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "vulnreport@tenable.com", "ID": "CVE-2021-20077", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Tenable Nessus Agent", "version": {"version_data": [{"version_value": "7.2.0 through 8.2.2"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Nessus Agent versions 7.2.0 through 8.2.2 were found to inadvertently capture the IAM role security token on the local host during initial linking of the Nessus Agent when installed on an Amazon EC2 instance. This could allow a privileged attacker to obtain the token."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Privilege Escalation"}]}]}, "references": {"reference_data": [{"name": "https://www.tenable.com/security/tns-2021-04-0", "refsource": "MISC", "url": "https://www.tenable.com/security/tns-2021-04-0"}, {"name": "https://www.tenable.com/security/tns-2021-07", "refsource": "MISC", "url": "https://www.tenable.com/security/tns-2021-07"}, {"name": "https://www.tenable.com/security/tns-2021-04-0", "refsource": "CONFIRM", "url": "https://www.tenable.com/security/tns-2021-04-0"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T17:30:07.670Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.tenable.com/security/tns-2021-04-0"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.tenable.com/security/tns-2021-07"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.tenable.com/security/tns-2021-04-0"}]}]}, "cveMetadata": {"assignerOrgId": "5ac1ecc2-367a-4d16-a0b2-35d495ddd0be", "assignerShortName": "tenable", "cveId": "CVE-2021-20077", "datePublished": "2021-03-19T18:46:43", "dateReserved": "2020-12-17T00:00:00", "dateUpdated": "2024-08-03T17:30:07.670Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:tenable:nessus_agent:*:*:*:*:*:*:*:*", "matchCriteriaId": "1F349161-FB60-4003-B328-6FD49D226195", "versionEndExcluding": "8.2.3", "versionStartIncluding": "7.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Nessus Agent versions 7.2.0 through 8.2.2 were found to inadvertently capture the IAM role security token on the local host during initial linking of the Nessus Agent when installed on an Amazon EC2 instance. This could allow a privileged attacker to obtain the token."}, {"lang": "es", "value": "Se encontr\u00f3 que las versiones 7.2.0 a 8.2.2 del Agente Nessus capturan inadvertidamente el token de seguridad del rol IAM en el host local durante la vinculaci\u00f3n inicial del Agente Nessus cuando se instala en una instancia de Amazon EC2. Esto podr\u00eda permitir a un atacante privilegiado obtener el token"}], "id": "CVE-2021-20077", "lastModified": "2024-11-21T05:45:53.020", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-03-19T19:15:13.497", "references": [{"source": "vulnreport@tenable.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.tenable.com/security/tns-2021-04-0"}, {"source": "vulnreport@tenable.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.tenable.com/security/tns-2021-04-0"}, {"source": "vulnreport@tenable.com", "tags": ["Not Applicable", "Vendor Advisory"], "url": "https://www.tenable.com/security/tns-2021-07"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.tenable.com/security/tns-2021-04-0"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.tenable.com/security/tns-2021-04-0"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Not Applicable", "Vendor Advisory"], "url": "https://www.tenable.com/security/tns-2021-07"}], "sourceIdentifier": "vulnreport@tenable.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}