CVE-2017-8051

Critical

Published: 21/04/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

Tenable Appliance versions 3.5 - 4.4.0, and possibly prior versions, contain a flaw in the simpleupload.py script in the Web UI. A remote attacker can inject arbitrary commands through manipulation of the tns_appliance_session_user parameter.

Risk Assessment

This vulnerability may lead to remote code execution, posing a serious threat to the security of the system and the organization's data.

Recommendation

It is recommended to update to the latest version of Tenable Appliance and to monitor and restrict access to the web interface.

Original NVD description (English source)

Tenable Appliance 3.5 - 4.4.0, and possibly prior versions, contains a flaw in the simpleupload.py script in the Web UI. Through the manipulation of the tns_appliance_session_user parameter, a remote attacker can inject arbitrary commands.