CVE-2018-1147: XSS
First published: Tue May 15 2018(Updated: )
In Nessus before 7.1.0, a XSS vulnerability exists due to improper input validation. A remote authenticated attacker could create and upload a .nessus file, which may be viewed by an administrator allowing for the execution of arbitrary script code in a user's browser session. In other scenarios, XSS could also occur by altering variables from the Advanced Settings.
Credit: vulnreport@tenable.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Tenable Nessus | <7.1.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID of this vulnerability is CVE-2018-1147.
What is the severity of CVE-2018-1147?
The severity of CVE-2018-1147 is medium with a severity value of 5.4.
What is the affected software for CVE-2018-1147?
The affected software for CVE-2018-1147 is Tenable Nessus version up to 7.1.0.
How does CVE-2018-1147 work?
CVE-2018-1147 allows a remote authenticated attacker to create and upload a .nessus file, which may be viewed by an administrator, allowing the execution of arbitrary script code in a user's browser session.
How can I fix CVE-2018-1147?
To fix CVE-2018-1147, you should update Nessus to version 7.1.0 or higher.
- collector/nvd-index
- agent/references
- agent/event
- agent/severity
- agent/weakness
- agent/author
- agent/type
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/tenable
- canonical/tenable nessus