Unscored severity · published Jul 23, 2014
CVE-2014-4980
The /server/properties resource in Tenable Web UI before 2.3.5 for Nessus 5.2.3 through 5.2.7 allows remote attackers to obtain sensitive information via the token parameter
–
CVSS
1.7%
EPSS
No
On KEV
Description
The /server/properties resource in Tenable Web UI before 2.3.5 for Nessus 5.2.3 through 5.2.7 allows remote attackers to obtain sensitive information via the token parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
Nessus · Tenable
5.2.3; 5.2.4; 5.2.5; 5.2.6; 5.2.7 · source: NVD
WU
Web UI · Tenable
through 2.3.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-4980
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-4980
Exploit
http://packetstormsecurity.com/files/127532/Tenable-Nessus-5.2.7-Parameter-Tampering-Authentication-Bypass.html
www.halock.com
http://www.halock.com/blog/cve-2014-4980-parameter-tampering-nessus-web-ui/
www.osvdb.org
http://www.osvdb.org/109376
www.securityfocus.com
http://www.securityfocus.com/archive/1/532839/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/68782
www.securitytracker.com
http://www.securitytracker.com/id/1030614
More from Nessus
9.8
CVE-2022-23852
Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES
9.8
CVE-2022-22822
addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow
9.8
CVE-2022-22823
build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow
9.8
CVE-2022-22824
defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow
8.8
CVE-2023-2005
Vulnerability in Tenable Tenable.Io, Tenable Nessus, Tenable Security Center.This issue affects Tenable.Io: before Plugin Feed ID #202306261202 ; Nessus: before Plugin Feed ID…