CVE-2022-28291: Medium severity nessus vulnerability
Insufficiently Protected Credentials: An authenticated user with debug privileges can retrieve stored Nessus policy credentials from the “nessusd” process in cleartext via process dumping. The affected products are all versions of Nessus Essentials and Professional. The vulnerability allows an attacker to access credentials stored in Nessus scanners, potentially compromising its customers’ network of assets.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-28291?
CVE-2022-28291 is a vulnerability in the Nessus scanner that allows an authenticated user with debug privileges to retrieve stored Nessus policy credentials in cleartext.
Which products are affected by CVE-2022-28291?
All versions of Nessus Essentials and Professional are affected by CVE-2022-28291.
What is the severity of CVE-2022-28291?
The severity of CVE-2022-28291 is medium, with a severity value of 6.5.
How can an attacker exploit CVE-2022-28291?
An attacker with debug privileges can exploit CVE-2022-28291 by retrieving stored Nessus policy credentials in cleartext via process dumping.
Is there a fix available for CVE-2022-28291?
Yes, Tenable has released a patch to fix CVE-2022-28291. It is recommended to update to the latest version of Nessus Essentials or Professional.