CVE-2020-5794: 
Tenable Nessus Network Monitor vulnerability analysis and mitigation

A vulnerability was identified in Nessus Network Monitor versions 5.11.0, 5.11.1, and 5.12.0 for Windows, tracked as CVE-2020-5794. The vulnerability was disclosed on November 5, 2020, and allows an authenticated local attacker with valid Windows system credentials to execute arbitrary code by manipulating files in specific user directory paths (Tenable Advisory).

The vulnerability has been assigned a Medium risk factor with a CVSSv2 Base Score of 6.8 and Temporal Score of 5.3. The CVSSv2 Vector is AV:L/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:OF/RC:C, indicating local access is required, low attack complexity, and single authentication needed for exploitation (Tenable Advisory).

If successfully exploited, this vulnerability could allow an authenticated attacker to execute arbitrary code on the affected system, potentially compromising the confidentiality, integrity, and availability of the system (Tenable Advisory).

The vulnerability requires valid credentials on the Windows system to exploit, and the attacker needs local access to the affected system. The attack involves copying user-supplied files to a specially constructed path in a specifically named user directory (Tenable Advisory).

Tenable has released version 5.12.1 of Nessus Network Monitor to address this vulnerability. Users are advised to upgrade to this version, which can be obtained from the Tenable Downloads Portal (Tenable Advisory).