CVE-2021-20135 Privilege escalation in Nessus
Local administrators can escalate privileges and execute arbitrary code on hosts running the Nessus Agent.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-20135?
CVE-2021-20135 is a medium-severity vulnerability in Tenable Nessus, published on 2 Nov 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Nessus versions 8.15.2 and earlier were found to contain a local privilege escalation vulnerability which could allow an authenticated, local administrator to run specific executables on the Nessus Agent host. Tenable has included a fix for this issue in Nessus 10.0.0. The installation files can be obtained from the Tenable Downloads Portal (https://www.tenable.com/downloads/nessus).
Which versions are affected by CVE-2021-20135?
It affects 1 product.
Products include Tenable Nessus.
How do I fix CVE-2021-20135?
No fix has been published for CVE-2021-20135 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-20135 being exploited?
There is no known exploitation of CVE-2021-20135 in the wild and no public exploit code.
Other vulnerabilities in Tenable Nessus
Sources
Also known as GHSA-8pfq-m65h-x2qr.