In Nessus before 7.1.0, a XSS vulnerability exists due to improper input validation.

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• tenable nessusbefore 7.1.0

Versions reported by the vendor

Affected version ranges reported by the assigning authority (tenable). Independent of NVD's CPE analysis and usually ahead of it.

• Tenable Tenable Nessus

  • All versions prior to 7.1.0affected

Other highest-scoring records for the same primary product.

• CVE-2023-2005Tenable Plugin Feed ID #202306261202 Fixes Privilege Escalation Vulnerability
  35Monitor
• CVE-2022-4313A vulnerability was reported where through modifying the scan variables, an authenticated user in Tenable products, that has Scan Policy Con
  35Monitor
• CVE-2023-0524As part of our Security Development Lifecycle, a potential privilege escalation issue was identified internally.
  35Monitor
• CVE-2023-0101A privilege escalation vulnerability was identified in Nessus versions 8.10.1 through 8.15.8 and 10.0.0 through 10.4.1.
  35Monitor
• CVE-2022-32973An authenticated attacker could create an audit file that bypasses PowerShell cmdlet checks and executes commands with administrator privile
  35Monitor
• CVE-2019-3974Nessus 8.5.2 and earlier on Windows platforms were found to contain an issue where certain system files could be overwritten arbitrarily, po
  33Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

User content is inserted into the page as HTML. The browser interprets the content as code rather than data.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1commentEl.innerHTML = comment.body;

1commentEl.textContent = comment.body;

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.