{"id":"CVE-2024-1367","state":"PUBLISHED","title":"Command Injection Vulnerability in Tenable Security Center","description":"\nA command injection vulnerability exists where an authenticated, remote attacker with administrator privileges on the Security Center application could modify Logging parameters, which could lead to the execution of arbitrary code on the Security Center host. \n\n","publishedAt":"2024-02-14T21:35:16.767Z","updatedAt":"2025-05-02T16:26:07.235Z","severity":{"score":7.2,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","source":"tenable"},"assigner":"tenable","products":["Tenable Security Center"],"affected":[{"vendor":"Tenable","product":"Security Center","defaultStatus":"affected","versions":[{"version":"0","status":"affected","lessThan":"6.3.0","versionType":"6.3.0"}],"platforms":["Linux"]}],"references":["https://www.tenable.com/security/tns-2024-02"],"weaknesses":["CWE-78"],"ingestedAt":"2026-10-29T20:06:59.846Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/1xxx/CVE-2024-1367.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-1367","state":"PUBLISHED","datePublished":"2024-02-14T21:35:16.767Z","dateUpdated":"2025-05-02T16:26:07.235Z","assignerShortName":"tenable","assignerOrgId":"5ac1ecc2-367a-4d16-a0b2-35d495ddd0be","dateReserved":"2024-02-08T19:43:20.585Z"},"containers":{"cna":{"title":"Command Injection Vulnerability in Tenable Security Center","descriptions":[{"lang":"en","value":"\nA command injection vulnerability exists where an authenticated, remote attacker with administrator privileges on the Security Center application could modify Logging parameters, which could lead to the execution of arbitrary code on the Security Center host. \n\n"}],"affected":[{"vendor":"Tenable","product":"Security Center","defaultStatus":"affected","versions":[{"version":"0","status":"affected","lessThan":"6.3.0","versionType":"6.3.0"}],"platforms":["Linux"]}],"references":[{"url":"https://www.tenable.com/security/tns-2024-02"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","description":"CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"tenable","orgId":"5ac1ecc2-367a-4d16-a0b2-35d495ddd0be","dateUpdated":"2024-02-14T21:35:16.767Z"},"credits":[{"lang":"en","type":"finder","user":"00000000-0000-4000-9000-000000000000","value":"Paweł Bednarz"}],"datePublic":"2024-02-14T19:00:00.000Z","impacts":[{"capecId":"CAPEC-248","descriptions":[{"lang":"en","value":"CAPEC-248 Command Injection"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"\n\n<div><div><p>Tenable has released Security Center 6.3.0 to address these issues. The installation files can be obtained from the Tenable Downloads Portal: <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.tenable.com/downloads/security-center\">https://www.tenable.com/downloads/security-center</a></p></div></div>"}],"value":"\nTenable has released Security Center 6.3.0 to address these issues. The installation files can be obtained from the Tenable Downloads Portal:  https://www.tenable.com/downloads/security-center https://www.tenable.com/downloads/security-center \n\n\n\n\n\n"}],"source":{"advisory":"TNS-2024-02","discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.tenable.com/security/tns-2024-02","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T18:40:19.949Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-02-15T20:05:10.392514Z","id":"CVE-2024-1367","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-05-02T16:26:07.235Z"}}]}}}