CVE-2021-20099 Privilege escalation in Nessus Agent
Local administrators can escalate privileges to run executables as the Nessus host service, requiring an upgrade to remediate.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-20099?
CVE-2021-20099 is a medium-severity vulnerability in Tenable Nessus, published on 28 Jun 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Nessus Agent 8.2.4 and earlier for Windows were found to contain multiple local privilege escalation vulnerabilities which could allow an authenticated, local administrator to run specific Windows executables as the Nessus host. This is different than CVE-2021-20100.
Which versions are affected by CVE-2021-20099?
It affects 1 product.
Products include Tenable Nessus.
How do I fix CVE-2021-20099?
No fix has been published for CVE-2021-20099 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-20099 being exploited?
There is no known exploitation of CVE-2021-20099 in the wild and no public exploit code.
Other vulnerabilities in Tenable Nessus
Sources
Also known as GHSA-3fcp-gh22-82v3.