CVE-2019-3962
Last modified
CVE-2019-3962 is a vulnerability of currently unknown severity. Content Injection vulnerability in Tenable Nessus prior to 8.5.0 may allow an authenticated, local attacker to exploit this vulnerability by convincing another targeted Nessus user to view a malicious URL and use Nessus to send fraudulent messages. Successful exploitation could allow the authenticated adversary to inject arbitrary text into the feed status, which will remain saved post session expiration.. EPSS estimates a 0.95% chance of exploitation in the next 30 days.
Description
Content Injection vulnerability in Tenable Nessus prior to 8.5.0 may allow an authenticated, local attacker to exploit this vulnerability by convincing another targeted Nessus user to view a malicious URL and use Nessus to send fraudulent messages. Successful exploitation could allow the authenticated adversary to inject arbitrary text into the feed status, which will remain saved post session expiration.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Tenable | Nessus | < 8.5.0 |
References
- http://www.securityfocus.com/bid/109025Third Party Advisory
- https://www.tenable.com/security/tns-2019-04Vendor Advisory
- http://www.securityfocus.com/bid/109025Third Party Advisory
- https://www.tenable.com/security/tns-2019-04Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-3962?
How severe is CVE-2019-3962?
How do I fix CVE-2019-3962?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-3956Dameware Remote Mini Control version 12.1.0.34 and prior con…
- CVE-2019-3957Dameware Remote Mini Control version 12.1.0.34 and prior con…7.4
- CVE-2019-3958Insufficient output sanitization in WallacePOS 1.4.3 allows …
- CVE-2019-3959Cross-site request forgery in WallacePOS 1.4.3 allows a remo…
- CVE-2019-3960Unrestricted upload of file with dangerous type in WallacePO…
- CVE-2019-3961Nessus versions 8.4.0 and earlier were found to contain a re…
- CVE-2019-3963In OpenEMR 5.0.1 and earlier, controller.php contains a refl…
- CVE-2019-3964In OpenEMR 5.0.1 and earlier, controller.php contains a refl…
- CVE-2019-3965In OpenEMR 5.0.1 and earlier, controller.php contains a refl…
- CVE-2019-3966In OpenEMR 5.0.1 and earlier, controller.php contains a refl…
- CVE-2019-3967In OpenEMR 5.0.1 and earlier, the patient file download inte…
- CVE-2019-3968In OpenEMR 5.0.1 and earlier, an authenticated attacker can …
Are you affected by CVE-2019-3962?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST