« Volver al listado

CVE-2024-3290

Estado: AplazadaAlta (8.2)—

A race condition vulnerability exists where an authenticated, local attacker on a Windows Nessus host could modify installation parameters at installation time, which could lead to the execution of arbitrary code on the Nessus host

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Tenable — NessusAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-3290",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-3290",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-05-17T19:23:42.628220Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "vulnreport@tenable.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.2,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 1.5
      }
    ]
  },
  "affected": [
    {
      "source": "vulnreport@tenable.com",
      "affectedData": [
        {
          "vendor": "Tenable",
          "product": "Nessus",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "10.7.3",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "Windows"
          ],
          "defaultStatus": "affected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:tenable:nessus:-:*:*:*:*:*:*:*"
          ],
          "vendor": "tenable",
          "product": "nessus",
          "versions": [
            {
              "status": "affected",
              "version": "-",
              "versionType": "custom",
              "lessThanOrEqual": "10.7.2"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-05-17T17:15:07.537",
  "references": [
    {
      "url": "https://www.tenable.com/security/tns-2024-08",
      "source": "vulnreport@tenable.com"
    },
    {
      "url": "https://www.tenable.com/security/tns-2024-08",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "vulnreport@tenable.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-367"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A race condition vulnerability exists where an authenticated, local attacker on a Windows Nessus host could modify installation parameters at installation time, which could lead to the execution of arbitrary code on the Nessus host"
    },
    {
      "lang": "es",
      "value": " Existe una vulnerabilidad de condición de ejecución donde un atacante local autenticado en un host Nessus de Windows podría modificar los parámetros de instalación en el momento de la instalación, lo que podría llevar a la ejecución de código arbitrario en el host Nessus."
    }
  ],
  "lastModified": "2026-06-17T07:43:43.630",
  "sourceIdentifier": "vulnreport@tenable.com"
}