Security Center
CVE-2024-5759
MEDIUM
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
An improper privilege management vulnerability exists in Tenable Security Center where an authenticated, remote attacker could view unauthorized objects and launch scans without having the required privileges
AnalysisAI
An improper privilege management vulnerability exists in Tenable Security Center where an authenticated, remote attacker could view unauthorized objects and launch scans without having the required. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Improper Privilege Management (CWE-269), which allows attackers to escalate privileges to gain unauthorized elevated access. An improper privilege management vulnerability exists in Tenable Security Center where an authenticated, remote attacker could view unauthorized objects and launch scans without having the required privileges Affected products include: Tenable Security Center.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply principle of least privilege, validate privilege transitions, implement proper role separation.
More in Security Center
View allAuthenticated OS command injection in Tenable Security Center allows a low-privileged user to run arbitrary operating sy
Remote code execution in Tenable Security Center's report-generation subsystem allows an authenticated, non-administrati
OS command injection in Tenable Security Center (Tenable.sc) lets an authenticated attacker execute arbitrary shell comm
OS command injection in Tenable Security Center (formerly Tenable.sc) lets a remote attacker run arbitrary operating-sys
Authenticated remote code execution in Tenable Security Center allows an attacker to inject shell metacharacters through
SQL injection in the ticketing REST API of Tenable Security Center (versions before 6.8.0) allows an authenticated non-a
Command injection in Tenable Security Center's file upload handler allows an authenticated low-privilege network attacke
Command injection in Tenable Security Center enables an authenticated administrator to achieve arbitrary OS command exec
OS command injection in Tenable Security Center (formerly Tenable.sc) lets authenticated users abuse the audit file uplo
SQL Injection in the Hardware Inventory report of Security Center 5.11.2. Rated high severity (CVSS 8.8), this vulnerabi
Privilege escalation in Tenable Security Center allows an authenticated Security Manager to manage users outside their a
Command injection (CWE-78) in Tenable Security Center versions prior to 6.9.0 enables a local attacker with write access
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today