CVE-2021-20077

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

Nessus Agent versions 7.2.0 through 8.2.2 were found to inadvertently capture the IAM role security token on the local host during initial linking of the Nessus Agent when installed on an Amazon EC2 instance. This could allow a privileged attacker to obtain the token.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	Tenable Nessus Agent	7.2.0 through 8.2.2

References

https://www.tenable.com/security/tns-2021-04-0Patch, Vendor Advisory
https://www.tenable.com/security/tns-2021-04-0Patch, Vendor Advisory
https://www.tenable.com/security/tns-2021-04-0Patch, Vendor Advisory
https://www.tenable.com/security/tns-2021-04-0Patch, Vendor Advisory
https://www.tenable.com/security/tns-2021-07Not Applicable, Vendor Advisory
https://www.tenable.com/security/tns-2021-04-0Patch, Vendor Advisory
https://www.tenable.com/security/tns-2021-04-0Patch, Vendor Advisory
https://www.tenable.com/security/tns-2021-04-0Patch, Vendor Advisory
https://www.tenable.com/security/tns-2021-04-0Patch, Vendor Advisory
https://www.tenable.com/security/tns-2021-07Not Applicable, Vendor Advisory

Timeline

Published: Mar 19, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-200789.1Manage Engine OpManager builds below 125346 are vulnerable to a remote denial of service vulnerability due to a path traversal issue in spar CVE-2021-200796.7Nessus versions 8.13.2 and earlier were found to contain a privilege escalation vulnerability which could allow a Nessus administrator user CVE-2021-20087.3Vulnerability in the Enterprise Manager for Fusion Middleware product of Oracle Enterprise Manager (component: FMW Control Plugin). The supp CVE-2021-200806.1Insufficient output sanitization in ManageEngine ServiceDesk Plus before version 11200 and ManageEngine AssetExplorer before version 6800 al CVE-2021-200817.2Incomplete List of Disallowed Inputs in ManageEngine ServiceDesk Plus before version 11205 allows a remote, authenticated attacker to execut CVE-2021-200838.8Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-plugin-query-object 2.2.3 allows a malic CVE-2021-200848.8Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-sparkle 1.5.2-beta allows a malicious us CVE-2021-200858.8Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in backbone-query-parameters 0.4.0 allows a malici CVE-2021-200868.8Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-bbq 1.2.1 allows a malicious user to inj CVE-2021-200878.8Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-deparam 0.5.1 allows a malicious user to CVE-2021-200888.8Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in mootools-more 1.6.0 allows a malicious user to CVE-2021-200898.8Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in purl 2.3.2 allows a malicious user to inject pr