Read the docs
TI-2023-00495 Aliases CVE-2023-0524GHSA-2r3h-3gcc-24g5

Improper privilege management in Tenable.io, Tenable.sc, Nessus

Priority MEDIUM 41CWE-269Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-269.

Summary

As part of our Security Development Lifecycle, a potential privilege escalation issue was identified internally. This could allow a malicious actor with sufficient permissions to modify environment variables and abuse an impacted plugin in order to escalate privileges. We have resolved the issue and also made several defense-in-depth fixes alongside. While the probability of successful exploitation is low, Tenable is committed to securing our customers’ environments and our products. The updates have been distributed via the Tenable plugin feed in feed serial numbers equal to or greater than #202212212055.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00639 50th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Tenable.io, Tenable.sc, NessusTenable plugin feed serial numbers less than #202212212055.—No fix listedCNA
  • Tenable.io, Tenable.sc, Nessus Vendor— Affected Tenable plugin feed serial numbers less than #202212212055. Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:tenable:nessus:-:*:*:*:*:*:*:*not specified by NVDVulnerableTenable
cpe:2.3:a:tenable:tenable.io:-:*:*:*:*:*:*:*not specified by NVDVulnerableTenable
cpe:2.3:a:tenable:tenable.sc:-:*:*:*:*:*:*:*not specified by NVDVulnerableTenable
  • cpe:2.3:a:tenable:nessus:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Tenable
  • cpe:2.3:a:tenable:tenable.io:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Tenable
  • cpe:2.3:a:tenable:tenable.sc:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Tenable

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-0524
  2. 2026-10-03 Alias added: GHSA-2r3h-3gcc-24g5
  3. 2026-10-24 EPSS moved to the 50th–90th percentile

References

Advisory 1

  • TI-2022-00687 Infinite loop in BN_mod_sqrt() reachable when parsing certificates CVSS 3.1HIGH 7.5
  • TI-2021-20962 In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the… CVSS 3.1HIGH 8.8
  • TI-2021-21076 In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize. CVSS 3.1HIGH 8.1
  • TI-2021-02413 NULL pointer deref in signature_algorithms processing CVSS 3.1MEDIUM 5.9
  • TI-2021-02414 CA certificate check bypass with X509_V_FLAG_X509_STRICT CVSS 3.1HIGH 7.4
  • TI-2022-07855 Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for… CVSS 3.1CRITICAL 9.8
See all 67 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences