Vulnerability · Published Mar 19, 2021 · Assigned by tenable
CVE-2021-20077
Medium 6.7
In plain English
A medium-severity security flaw in Tenable Nessus Agent. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).
Severity (CVSS NVD)6.7Medium
Exploit odds (30 days)0.3%top 71.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Nessus Agent versions 7.2.0 through 8.2.2 were found to inadvertently capture the IAM role security token on the local host during initial linking of the Nessus Agent when installed on an Amazon EC2 instance. This could allow a privileged attacker to obtain the token.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Tenable Nessus Agent | 7.2.0 through 8.2.2 |
References
- https://www.tenable.com/security/tns-2021-04-0 x_refsource_MISC
- https://www.tenable.com/security/tns-2021-07 x_refsource_MISC