CVE-2024-1367: Command Injection Vulnerability in Tenable Security Center
First published: Wed Feb 14 2024(Updated: )
A command injection vulnerability exists where an authenticated, remote attacker with administrator privileges on the Security Center application could modify Logging parameters, which could lead to the execution of arbitrary code on the Security Center host.
Credit: vulnreport@tenable.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Tenable.sc | <6.3.0 |
Remedy
Tenable has released Security Center 6.3.0 to address these issues. The installation files can be obtained from the Tenable Downloads Portal: https://www.tenable.com/downloads/security-center https://www.tenable.com/downloads/security-center
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-1367?
CVE-2024-1367 is classified as a critical vulnerability due to the potential for remote code execution.
How do I fix CVE-2024-1367?
To fix CVE-2024-1367, upgrade Tenable Security Center to version 6.3.0 or later.
Who is affected by CVE-2024-1367?
CVE-2024-1367 affects authenticated remote attackers with administrator privileges on Tenable Security Center versions prior to 6.3.0.
What types of attacks can exploit CVE-2024-1367?
CVE-2024-1367 can be exploited by attackers modifying Logging parameters to execute arbitrary code on the host.
Is authentication required to exploit CVE-2024-1367?
Yes, exploitation of CVE-2024-1367 requires authentication with administrator privileges.
- agent/references
- agent/weakness
- agent/title
- agent/remedy
- agent/description
- agent/type
- agent/first-publish-date
- agent/severity
- agent/author
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/tenable
- canonical/tenable.sc