CVE-2024-0971: 
Tenable Nessus vulnerability analysis and mitigation

CVE-2024-0971 is a SQL injection vulnerability discovered in Nessus versions 10.6.4 and earlier. The vulnerability was reported on January 25, 2024, and was patched with the release of Nessus 10.7.0 on February 6, 2024. This vulnerability affects authenticated users with low-level privileges who could potentially alter scan database content (Tenable Advisory).

The vulnerability has been assigned a CVSSv3.1 base score of 6.5 (Medium), with the following vector: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. This indicates that the vulnerability is network-accessible, requires low attack complexity, needs low privileges, requires no user interaction, has no impact on confidentiality, but has a high impact on integrity with no impact on availability (Tenable Advisory, NVD).

The vulnerability allows an authenticated attacker with low-level privileges to potentially alter scan database content, which could compromise the integrity of scan results and potentially affect security assessments (Tenable Advisory).

Tenable has released Nessus version 10.7.0 to address this vulnerability. Users are advised to upgrade to this version through the Tenable Downloads Portal to mitigate the risk (Tenable Advisory).