CVE-2017-8051 Tenable Appliance 3.5 - 4.4.0, and possibly prior versions, contains a flaw in the simpleupload.py script in the Web UI. Through the manipulation of the tns_appliance_session_user parameter, a remote....
CriticalCVSS 9.8
EPSS 16.5%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Tenable Appliance 3.5 - 4.4.0, and possibly prior versions, contains a flaw in the simpleupload.py script in the Web UI. Through the manipulation of the tns_appliance_session_user parameter, a remote attacker can inject arbitrary commands.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tenable appliance | = 3.4.0 | No fix listed |
| tenable appliance | = 3.5.0 | No fix listed |
| tenable appliance | = 3.5.1 | No fix listed |
| tenable appliance | = 3.10.0 | No fix listed |
| tenable appliance | = 3.10.1 | No fix listed |
| tenable appliance | = 4.0.0 | No fix listed |
| tenable appliance | = 4.1.0 | No fix listed |
| tenable appliance | = 4.2.0 | No fix listed |
| tenable appliance | = 4.3.0 | No fix listed |
| tenable appliance | = 4.3.1 | No fix listed |
| tenable appliance | = 4.4.0 | No fix listed |
References
- www.tenable.com patch vendor-advisory
- vulndb.cyberriskanalytics.com permissions-required
- 41892 exploit third-party-advisory vdb-entry