CVE-2024-3291

Published: May 17, 2024Modified: Jun 17, 2026Deferred

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: vulnreport@tenable.com (Secondary)

Description

When installing Nessus Agent to a directory outside of the default location on a Windows host, Nessus Agent versions prior to 10.6.4 did not enforce secure permissions for sub-directories. This could allow for local privilege escalation if users had not secured the directories in the non-default installation location.

Related CWEs

CWE-281

Improper Preservation of Permissions

The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.

References (2)

https://www.tenable.com/security/tns-2024-09

Source: vulnreport@tenable.com

https://www.tenable.com/security/tns-2024-09

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.