Nessus Windows GUI Unspecified Script HTML Injection Vulnerability

Bugtraq ID:	24677
Class:	Input Validation Error
CVE:	CVE-2007-3546
Remote:	Yes
Local:	No
Published:	Jun 19 2007 12:00AM
Updated:	May 07 2015 05:37PM
Credit:	Individuals at CERT Japan are credited with the discovery of this vulnerability.
Vulnerable:	Nessus Nessus 3.0.5 Nessus Nessus 3.0
Not Vulnerable:	Nessus Nessus 3.0.6

Nessus Windows GUI Unspecified Script HTML Injection Vulnerability

Nessus is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied input data.

Exploiting this issue may allow an attacker to execute HTML and script code in the context of the affected site, to steal cookie-based authentication credentials, or to control how the site is rendered to the user; other attacks are also possible.

Versions prior to Nessus 3.0.6 are vulnerable.

Nessus Windows GUI Unspecified Script HTML Injection Vulnerability

Attackers can use a browser to exploit this issue.

Nessus Windows GUI Unspecified Script HTML Injection Vulnerability

Solution:
The vendor has released Nessus 3.0.6 to address this issue; please contact the vendor for information on obtaining and applying fixes.

Nessus Windows GUI Unspecified Script HTML Injection Vulnerability

References:

• 26th June, 2007: Nessus 3.0.6 released (Nessus)
  
• Nessus Home Page (Tenable Network Security)