CVE-2023-3253: 
Tenable Nessus vulnerability analysis and mitigation

CVE-2023-3253 is an improper authorization vulnerability discovered in Tenable Nessus versions 10.5.4 and earlier. The vulnerability was disclosed on August 29, 2023, and allows an authenticated, low privileged remote attacker to view a list of all users available in the application (Tenable Advisory).

The vulnerability has been assigned a CVSSv3.1 Base Score of 4.3 (MEDIUM) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. This indicates that the vulnerability can be exploited over the network, requires low attack complexity, needs low privileges, requires no user interaction, has unchanged scope, and only impacts confidentiality at a low level (NVD).

The primary impact of this vulnerability is the unauthorized disclosure of user information. An attacker with low-level privileges can view a complete list of all users in the Nessus application, potentially exposing sensitive user information (Tenable Advisory).

Tenable has released Nessus version 10.6.0 to address this vulnerability. Users are strongly encouraged to upgrade to the latest version to mitigate the risk. The fix can be obtained through the Tenable Downloads Portal (Tenable Advisory).