CVE-2014-4980 The /server/properties resource in Tenable Web UI before 2.3.5 for Nessus 5.2.3 through 5.2.7 allows remote attackers to obtain sensitive information via the token parameter.
MediumCVSS 5.0
EPSS 1.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The /server/properties resource in Tenable Web UI before 2.3.5 for Nessus 5.2.3 through 5.2.7 allows remote attackers to obtain sensitive information via the token parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tenable Nessus | = 5.2.3 | No fix listed |
| tenable Nessus | = 5.2.4 | No fix listed |
| tenable Nessus | = 5.2.5 | No fix listed |
| tenable Nessus | = 5.2.6 | No fix listed |
| tenable Nessus | = 5.2.7 | No fix listed |
| tenable web ui | <= 2.3.4 | No fix listed |
References
- packetstormsecurity.com exploit
- www.halock.com
- 109376 vdb-entry
- 20140718 CVE-2014-4980 Parameter Tampering in Nessus Web UI - Remote Information Disclosure mailing-list
- 68782 vdb-entry
- 1030614 vdb-entry
- www.tenable.com vendor-advisory