Read the docs
TI-2022-03951 Aliases CVE-2022-4313GHSA-q2xm-492x-5xjf

Uncontrolled search path in Tenable.io, Tenable.sc and Nessus

Priority MEDIUM 43CWE-427Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-427.

Summary

A vulnerability was reported where through modifying the scan variables, an authenticated user in Tenable products, that has Scan Policy Configuration roles, could manipulate audit policy variables to execute arbitrary commands on credentialed scan targets.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01236 69th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Tenable.io, Tenable.sc and NessusPlugin Feed Version 202212081951 and earlier—No fix listedCNA
  • Tenable.io, Tenable.sc and Nessus Vendor— Affected Plugin Feed Version 202212081951 and earlier Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:tenable:nessus:*:*:*:*:*:*:*:*before 10.4.2VulnerableTenable
cpe:2.3:a:tenable:plugin_feed:*:*:*:*:*:*:*:*before 202212081952VulnerableTenable
  • cpe:2.3:a:tenable:nessus:*:*:*:*:*:*:*:* Versions before 10.4.2 Vulnerable ·Tenable
  • cpe:2.3:a:tenable:plugin_feed:*:*:*:*:*:*:*:* Versions before 202212081952 Vulnerable ·Tenable

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-4313
  2. 2026-10-03 Alias added: GHSA-q2xm-492x-5xjf

References

Advisory 1

  • TI-2022-00687 Infinite loop in BN_mod_sqrt() reachable when parsing certificates CVSS 3.1HIGH 7.5
  • TI-2021-20962 In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the… CVSS 3.1HIGH 8.8
  • TI-2021-21076 In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize. CVSS 3.1HIGH 8.1
  • TI-2021-02413 NULL pointer deref in signature_algorithms processing CVSS 3.1MEDIUM 5.9
  • TI-2021-02414 CA certificate check bypass with X509_V_FLAG_X509_STRICT CVSS 3.1HIGH 7.4
  • TI-2022-07855 Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for… CVSS 3.1CRITICAL 9.8
See all 67 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences