CVE-2024-3289: High severity Tenable Nessus vulnerability
When installing Nessus to a directory outside of the default location on a Windows host, Nessus versions prior to 10.7.3 did not enforce secure permissions for sub-directories. This could allow for local privilege escalation if users had not secured the directories in the non-default installation location.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3289?
CVE-2024-3289 is considered a high severity vulnerability due to the potential for local privilege escalation on affected systems.
How do I fix CVE-2024-3289?
To fix CVE-2024-3289, upgrade Nessus to version 10.7.3 or later which enforces secure permissions for non-default installation directories.
What versions of Nessus are affected by CVE-2024-3289?
CVE-2024-3289 affects Nessus versions prior to 10.7.3.
Can CVE-2024-3289 be exploited remotely?
No, CVE-2024-3289 can only be exploited locally by users who have access to the non-default installation directories.
What conditions must be met for CVE-2024-3289 to be a risk?
For CVE-2024-3289 to pose a risk, users must have not secured permissions on the sub-directories of the non-default installation location.