CVE-2021-20077: 
Tenable Nessus Agent vulnerability analysis and mitigation

CVE-2021-20077 is a security vulnerability discovered in Nessus Agent versions 7.2.0 through 8.2.2. The vulnerability was disclosed on March 18, 2021, affecting Tenable's Nessus Agent software when installed on Amazon EC2 instances. The vulnerability involves the inadvertent capture of IAM role security tokens during the initial linking process of the Nessus Agent (Tenable Advisory).

The vulnerability has a CVSS v2 Base Score of 1.7 and Temporal Score of 1.4, with the vector string AV:L/AC:L/Au:S/C:P/I:N/A:N/E:F/RL:OF/RC:C. This indicates a local attack vector requiring authentication with partial confidentiality impact (Tenable Advisory).

When exploited, this vulnerability could allow a privileged attacker to obtain the IAM role security token from the local host during the initial linking of the Nessus Agent when installed on an Amazon EC2 instance (CVE Mitre).

The vulnerability requires local access and authenticated user privileges to exploit. The attack complexity is considered low, but authentication is required for successful exploitation (Tenable Advisory).

Tenable has released Nessus Agent version 8.2.3 to address this vulnerability. Users are advised to upgrade to this version or later to mitigate the risk. The updated version can be obtained from the Tenable Downloads Portal (Tenable Advisory).