CVE-2024-3289

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

When installing Nessus to a directory outside of the default location on a Windows host, Nessus versions prior to 10.7.3 did not enforce secure permissions for sub-directories. This could allow for local privilege escalation if users had not secured the directories in the non-default installation location.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-281

Affected software

No affected versions have been published.

Timeline

Published: May 17, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-328906.1librespeed/speedtest is an open source, self-hosted speed test for HTML5. In affected versions missing neutralization of the ISP information CVE-2024-328917.0In sec_media_unprotect of media.c, there is a possible memory corruption due to a race condition. This could lead to local escalation of pri CVE-2024-328927.8In handle_init of goodix/main/main.c, there is a possible memory corruption due to type confusion. This could lead to local escalation of pr CVE-2024-328935.5In _s5e9865_mif_set_rate of exynos_dvfs.c, there is a possible out of bounds read due to improper casting. This could lead to local informat CVE-2024-328947.5In bc_get_converted_received_bearer of bc_utilities.c, there is a possible out of bounds read due to a missing bounds check. This could lead CVE-2024-328957.8In BCMFASTPATH of dhd_msgbuf.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation o CVE-2024-328967.8there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional exe CVE-2024-328975.9In ProtocolCdmaCallWaitingIndAdapter::GetCwInfo() of protocolsmsadapter.cpp, there is a possible out of bounds read due to a missing bounds CVE-2024-328984.7In ProtocolCellIdentityParserV4::Parse() of protocolnetadapter.cpp, there is a possible out of bounds read due to a missing bounds check. Th CVE-2024-328997.0In gpu_pm_power_off_top_nolock of pixel_gpu_power.c, there is a possible compromise of protected memory due to a race condition. This could CVE-2024-32908.2A race condition vulnerability exists where an authenticated, local attacker on a Windows Nessus host could modify installation parameters a CVE-2024-329007.8In lwis_fence_signal of lwis_debug.c, there is a possible Use after Free due to improper locking. This could lead to local escalation of pri