When linking a Nessus scanner or agent to Tenable.io or other manager, Nessus 6.x before 6.11 does not verify the manager's TLS certificate when making the initial outgoing connection. This could allow man-in-the-middle attacks.
References
Link | Resource |
---|---|
https://www.tenable.com/security/tns-2017-11 | Vendor Advisory |
http://www.securitytracker.com/id/1039141 | Third Party Advisory VDB Entry |
Configurations
Configuration 1 (hide)
|
Information
Published : 2017-08-09 05:29
Updated : 2017-08-24 09:28
NVD link : CVE-2017-11506
Mitre link : CVE-2017-11506
JSON object : View
CWE
CWE-295
Improper Certificate Validation
Products Affected
tenable
- nessus