CVE-2021-20106: 
Tenable Nessus vulnerability analysis and mitigation

CVE-2021-20106 is a privilege escalation vulnerability discovered in Nessus Agent versions 8.2.5 and earlier. The vulnerability allows a Nessus administrator user to upload a specially crafted file that could lead to gaining administrator privileges on the Nessus host. This vulnerability was disclosed on June 28, 2021, and was addressed with the release of Nessus Agent 8.3.0 (Tenable Advisory).

The vulnerability has been assigned multiple severity scores: a CVSS v3.1 Base Score of 7.7 (High) with vector string CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H, and a CVSSv2 Base Score of 6.8 with vector string AV:L/AC:L/Au:S/C:C/I:C/A:C. The vulnerability requires local access and high privileges for exploitation, with user interaction required (Tenable Advisory).

If successfully exploited, this vulnerability could allow an attacker to escalate privileges to administrator level on the Nessus host system, potentially leading to complete system compromise with high impacts on confidentiality, integrity, and availability (Tenable Advisory).

Tenable has released Nessus Agent 8.3.0 to address this vulnerability. Users are advised to upgrade to this version or later to mitigate the risk. The installation files can be obtained from the Tenable Downloads Portal (Tenable Advisory).