Read the docs
TI-2024-03085 Aliases CVE-2024-3290GHSA-qx57-q6j5-g6mg

Race condition in Tenable Nessus

Priority LOW 37CWE-367Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

A race condition vulnerability exists where an authenticated, local attacker on a Windows Nessus host could modify installation parameters at installation time, which could lead to the execution of arbitrary code on the Nessus host

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00184 8th percentileScored 2026-11-07
Fix Fixed Nessus (Tenable): 10.7.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TenableNessusbefore 10.7.310.7.3Patch availableCNA
  • Nessus VendorTenable Affected before 10.7.3 Fixed in 10.7.3 Patch available CNA

CPE names CISA-ADP · 1

CPEVersionsRoleVendor
cpe:2.3:a:tenable:nessus:-:*:*:*:*:*:*:*not specified by CISA-ADP—Tenable
  • cpe:2.3:a:tenable:nessus:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·Tenable

Remediation

  • Fix · CNA Nessus (Tenable) Fixed in 10.7.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Tenable Nessus 10.7.3

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2024-03084 When installing Nessus to a directory outside of the default location on a Windows host…Priority LOW 35
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-3290
  2. 2026-10-03 Alias added: GHSA-qx57-q6j5-g6mg

References

Other 1

  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-17490 mod_proxy SSRF KEVCVSS 3.1CRITICAL 9.0
  • TI-2021-02645 SM2 Decryption Buffer Overflow CVSS 3.1CRITICAL 9.8
  • TI-2020-08897 Potential XSS vulnerability in jQuery KEVCVSS 3.1MEDIUM 6.9
  • TI-2021-20274 Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlier CVSS 3.1CRITICAL 9.8
  • TI-2022-00687 Infinite loop in BN_mod_sqrt() reachable when parsing certificates CVSS 3.1HIGH 7.5
See all 217 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences