Vulnerability Details CVE-2023-24493
A formula injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. An authenticated attacker could leverage the reporting system to export reports containing formulas, which would then require a victim to approve and execute on a host.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 38.0%
CVSS Severity
CVSS v3 Score 5.7
References
Products affected by CVE-2023-24493
-
cpe:2.3:a:tenable:tenable.sc:-
-
cpe:2.3:a:tenable:tenable.sc:5.13.0
-
cpe:2.3:a:tenable:tenable.sc:5.14.0
-
cpe:2.3:a:tenable:tenable.sc:5.14.1
-
cpe:2.3:a:tenable:tenable.sc:5.16.0
-
cpe:2.3:a:tenable:tenable.sc:5.17.0
-
cpe:2.3:a:tenable:tenable.sc:5.18.0
-
cpe:2.3:a:tenable:tenable.sc:5.19.0
-
cpe:2.3:a:tenable:tenable.sc:5.19.1
-
cpe:2.3:a:tenable:tenable.sc:5.20.0
-
cpe:2.3:a:tenable:tenable.sc:5.20.1
-
cpe:2.3:a:tenable:tenable.sc:5.21.0
-
cpe:2.3:a:tenable:tenable.sc:5.23.1