CVE-2021-20077
Medium
Description
Nessus Agent versions 7.2.0 through 8.2.2 were found to inadvertently capture the IAM role security token on the local host during initial linking of the Nessus Agent when installed on an Amazon EC2 instance. This could allow a privileged attacker to obtain the token.
SeverityMedium
CVSS6.7
Exploit probability—
ProductTenable Nessus Agent
PublishedMar 19, 2021
First seenMar 19, 2021
How to fix
Update
- tenable nessus_agent8.2.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tenable nessus_agent | 7.2.0 ≤ v < 8.2.3 | 8.2.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.