SB2021040621 - Information disclosure in Nessus
Published: April 6, 2021
Security Bulletin ID
SB2021040621
CSH Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Information disclosure (CVE-ID: CVE-2021-20077)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to Nessus Agent inadvertently
captures the IAM role security token on the local host during initial
linking of the Nessus Agent when installed on an Amazon EC2 instance. A local privileged user can obtain the token.
Remediation
Install update from vendor's website.