CVE-2024-3291

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

When installing Nessus Agent to a directory outside of the default location on a Windows host, Nessus Agent versions prior to 10.6.4 did not enforce secure permissions for sub-directories. This could allow for local privilege escalation if users had not secured the directories in the non-default installation location.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-281

Affected software

VendorProductVersions
TenableNessus Agent< 10.6.4
tenablenessus_agent< 10.6.4

References

Timeline

Published
May 17, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-329105.5In handle_msg_shm_map_req of trusty/user/base/lib/spi/srv/tipc/tipc.c, there is a possible stack data disclosure due to uninitialized data. CVE-2024-329119.8There is a possible escalation of privilege due to improperly used crypto. This could lead to remote escalation of privilege with no additioCVE-2024-329125.5there is a possible persistent Denial of Service due to test/debugging code left in a production build. This could lead to local denial of sCVE-2024-329139.8In wl_notify_rx_mgmt_frame of wl_cfg80211.c, there is a possible out of bounds write due to an integer overflow. This could lead to remote cCVE-2024-329145.5In tpu_get_int_state of tpu.c, there is a possible information disclosure due to uninitialized data. This could lead to local information diCVE-2024-329154.3In CellInfoListParserV2::FillCellInfo() of protocolnetadapter.cpp, there is a possible out of bounds read due to a missing bounds check. ThiCVE-2024-329165.9In fvp_freq_histogram_init of fvp.c, there is a possible Information Disclosure due to uninitialized data. This could lead to local informatCVE-2024-329177.1In pl330_dma_from_peri_start() of fp_spi_dma.c, there is a possible out of bounds write due to a missing bounds check. This could lead to loCVE-2024-329186.1Permission Bypass allowing attackers to disable HDCP 2.2 encryption by not completing the HDCP Key Exchange initialization stepsCVE-2024-329197.8In lwis_add_completion_fence of lwis_fence.c, there is a possible escalation of privilege due to type confusion. This could lead to local esCVE-2024-32928.2A race condition vulnerability exists where an authenticated, local attacker on a Windows Nessus Agent host could modify installation parameCVE-2024-329207.1In set_secure_reg of sac_handler.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local informati
CVE-2024-3291: High severity, CVSS 7.8 | Vulnix