CVE-2023-3251 Pass-back vulnerability in Nessus

What is CVE-2023-3251?

CVE-2023-3251 is a medium-severity vulnerability in Tenable Nessus, published on 29 Aug 2023. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

A pass-back vulnerability exists where an authenticated, remote attacker with administrator privileges could uncover stored SMTP credentials within the Nessus application.This issue affects Nessus: before 10.6.0.

Weakness: CWE-522

Which versions are affected by CVE-2023-3251?

It affects 1 product.

Products include Tenable Nessus.

How do I fix CVE-2023-3251?

No fix has been published for CVE-2023-3251 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-3251 being exploited?

There is no known exploitation of CVE-2023-3251 in the wild and no public exploit code.

Other vulnerabilities in Tenable Nessus

• CVE-2022-4313 Command injection in Tenable.io, Tenable.sc and Nessus High 8.8
• CVE-2023-0524 Privilege escalation in Tenable.io, Tenable.sc, Nessus High 8.8
• CVE-2023-0101 Privilege escalation in Nessus High 8.8
• CVE-2022-32973 Privilege escalation in Nessus High 8.8
• CVE-2025-36630 Local Privilege Escalation High 8.4

All Tenable Nessus vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4xxf-ff6m-9829.