CVE-2024-3232: Formula Injection Vulnerability
First published: Tue Jul 16 2024(Updated: )
A formula injection vulnerability exists in Tenable Identity Exposure where an authenticated remote attacker with administrative privileges could manipulate application form fields in order to trick another administrator into executing CSV payloads. - CVE-2024-3232
Credit: vulnreport@tenable.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Tenable |
Remedy
Tenable has released Tenable Identity Exposure Version 3.59.4 to address these issues. The installation files can be obtained from the Tenable Downloads Portal: https://www.tenable.com/downloads/identity-exposure
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-3232?
CVE-2024-3232 is classified as a medium severity vulnerability due to its potential impact on administrative privileges.
How do I fix CVE-2024-3232?
To fix CVE-2024-3232, ensure that software updates are applied to close the vulnerability in Tenable Identity Exposure.
What are the consequences of exploiting CVE-2024-3232?
Exploiting CVE-2024-3232 allows an attacker to manipulate form fields and potentially execute malicious CSV payloads on vulnerable systems.
Who is affected by CVE-2024-3232?
CVE-2024-3232 affects users of Tenable Identity Exposure who have administrative privileges.
Is CVE-2024-3232 remotely exploitable?
Yes, CVE-2024-3232 can be remotely exploited by authenticated attackers with administrative access.
- agent/remedy
- agent/weakness
- agent/title
- agent/references
- agent/first-publish-date
- agent/type
- agent/description
- collector/nvd-api
- source/NVD
- agent/severity
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/tenable
- canonical/tenable