Privilege Escalation in Tenable Security Center

Executive Summary

This is a privilege escalation vulnerability in Tenable Security Center. A user with the Security Manager role and manage user permission on one group can modify users in other groups, bypassing access control restrictions.

Useful 0 Not Useful 0

Impact Analysis

An attacker with limited access could escalate privileges to manage users across multiple groups, potentially gaining unauthorized control over user accounts and permissions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or modifications to user data, violating data protection requirements in GDPR and HIPAA, which mandate strict access controls and user management.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately review and restrict user permissions in Tenable Security Center. Ensure users with Security Manager role do not have manage user permission across multiple groups. Apply the principle of least privilege and audit all user roles and permissions.

Useful 0 Not Useful 0