Vulnerability Details : CVE-2021-20077
Nessus Agent versions 7.2.0 through 8.2.2 were found to inadvertently capture the IAM role security token on the local host during initial linking of the Nessus Agent when installed on an Amazon EC2 instance. This could allow a privileged attacker to obtain the token.
Products affected by CVE-2021-20077
- cpe:2.3:a:tenable:nessus_agent:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2021-20077
0.04%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 10 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2021-20077
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.2
|
HIGH | AV:L/AC:L/Au:N/C:C/I:C/A:C |
3.9
|
10.0
|
NIST | |
|
6.7
|
MEDIUM | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
0.8
|
5.9
|
NIST |
References for CVE-2021-20077
-
https://www.tenable.com/security/tns-2021-07
[R1] Nessus 8.14.0 Fixes One Vulnerability - Security Advisory | Tenable®Not Applicable;Vendor Advisory
-
https://www.tenable.com/security/tns-2021-04-0
[R1] Nessus Agent 8.2.3 Fixes Multiple Vulnerabilities - Security Advisory | Tenable®Patch;Vendor Advisory
Jump to