critical9.8Public exploit code
CVE-2017-8051
Tenable Appliance 3.5 - 4.4.0, and possibly prior versions, contains a flaw in the simpleupload.py script in the Web UI.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Tenable Appliance < 4.5 - Root Remote Code Execution2017-04-18 · remote · linux
Impact
Tenable Appliance 3.5 - 4.4.0, and possibly prior versions, contains a flaw in the simpleupload.py script in the Web UI. Through the manipulation of the tns_appliance_session_user parameter, a remote attacker can inject arbitrary commands.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Tenable | Appliance | Versions 3.4.0, 3.5.0, 3.5.1, 3.10.0, 3.10.1, 4.0.0 |