CVE-2025-36625: Log Poisoning in Nessus
Published Apr 18, 2025
·Updated
In Nessus versions prior to 10.8.4, a non-authenticated attacker could alter Nessus logging entries by manipulating http requests to the application.
Affected Software
1 affected component
Tenable Nessus<10.8.4
Remediation
Information
Tenable has released Nessus 10.8.4 to address these issues. The installation files can be obtained from the Tenable Downloads Portal: https://www.tenable.com/downloads/nessus https://www.tenable.com/downloads/nessus
Event History
Apr 18, 2025
CVE Published
via MITRE·07:17 PM
Data Sourced
via MITRE·07:17 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·08:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-36625?
CVE-2025-36625 is classified as a moderate severity vulnerability.
2
How does CVE-2025-36625 affect Tenable Nessus?
CVE-2025-36625 allows a non-authenticated attacker to manipulate logging entries by altering HTTP requests.
3
What versions of Nessus are affected by CVE-2025-36625?
Nessus versions prior to 10.8.4 are affected by CVE-2025-36625.
4
How do I mitigate CVE-2025-36625?
To mitigate CVE-2025-36625, update Tenable Nessus to version 10.8.4 or later.
5
Can CVE-2025-36625 be exploited remotely?
Yes, CVE-2025-36625 can be exploited remotely by a non-authenticated attacker.