CVE-2018-1141

low-risk

Published 2018-03-20

When installing Nessus to a directory outside of the default location, Nessus versions prior to 7.0.3 did not enforce secure permissions for sub-directories. This could allow for local privilege escalation if users had not secured the directories in the installation location.

Do I need to act?

0.04% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.0/10 High

LOCAL / HIGH complexity

Affected Products (1)

Nessus

Affected Vendors

Tenable

References (4)

Third Party Advisory http://www.securitytracker.com/id/1040557

Vendor Advisory https://www.tenable.com/security/tns-2018-01

Third Party Advisory http://www.securitytracker.com/id/1040557

Vendor Advisory https://www.tenable.com/security/tns-2018-01

/ 100

low-risk

Severity 18/34 · Moderate

Exploitability 0/34 · Minimal

Exposure 5/34 · Minimal