CVE-2022-4313

moderate-risk
Published 2023-03-15

A vulnerability was reported where through modifying the scan variables, an authenticated user in Tenable products, that has Scan Policy Configuration roles, could manipulate audit policy variables to execute arbitrary commands on credentialed scan targets.

Do I need to act?

-
0.70% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.8/10 High
NETWORK / LOW complexity

Affected Products (2)

Plugin Feed

Affected Vendors

Tenable

References (2)

Vendor Advisory https://www.tenable.com/security/tns-2023-14
Vendor Advisory https://www.tenable.com/security/tns-2023-14
39
/ 100
moderate-risk
Severity 30/34 · Critical
Exploitability 2/34 · Minimal
Exposure 7/34 · Low