CVE-2024-1891 in Security Center
Summary
by MITRE • 06/12/2024
A stored cross site scripting vulnerability exists in Tenable Security Center where an authenticated, remote attacker could inject HTML code into a web application scan result page.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 03/24/2025
The vulnerability identified as CVE-2024-1891 represents a critical stored cross site scripting flaw within Tenable Security Center, a widely deployed network security vulnerability management platform. This security weakness resides in the web application's handling of scan results, specifically affecting the display mechanism where user-supplied data is not properly sanitized before being rendered to end users. The vulnerability enables authenticated attackers to inject malicious HTML code that persists within the application's scan result pages, making it a stored XSS vulnerability rather than a reflected one. The attack vector requires an authenticated session, meaning that an attacker must first compromise valid credentials to exploit this weakness, though the impact remains severe given the privileged nature of Tenable Security Center users.
The technical implementation of this vulnerability stems from inadequate input validation and output encoding mechanisms within the Tenable Security Center's web interface. When scan results are generated and displayed, the application fails to properly escape or filter user-controllable data elements that may contain HTML or JavaScript payloads. This flaw allows an attacker who has authenticated access to the system to craft malicious input that gets stored in the application's database or storage layer. When other authenticated users subsequently view the affected scan result pages, their browsers execute the injected malicious code, potentially leading to session hijacking, credential theft, or redirection to malicious sites. The vulnerability specifically affects the web application scan result page functionality, which is a core component of the platform's threat detection and remediation capabilities.
The operational impact of CVE-2024-1891 extends beyond simple data corruption or display issues, as it creates a persistent backdoor for attackers within the security monitoring environment. Security teams who rely on Tenable Security Center for vulnerability assessment and threat detection could unknowingly be compromised, as the injected malicious code could be used to exfiltrate sensitive security data, manipulate scan results to hide malicious activity, or establish persistent access points. The vulnerability undermines the trust model of the security platform itself, as the very tool designed to identify and remediate security weaknesses becomes a potential vector for attack. Organizations utilizing Tenable Security Center may experience unauthorized access to critical security information, disruption of security operations, and potential data breaches that could compromise their entire security infrastructure. This vulnerability particularly affects enterprise environments where security teams depend on accurate scan results for incident response and compliance reporting.
Mitigation strategies for CVE-2024-1891 should prioritize immediate patching of the affected Tenable Security Center versions, as this represents a critical security flaw that requires vendor-provided remediation. Organizations should implement additional network segmentation and access controls to limit the scope of potential exploitation, particularly focusing on credential protection and privileged access management. Security monitoring should be enhanced to detect unusual activity patterns that might indicate exploitation attempts, including monitoring for suspicious scan result modifications or unexpected user behavior within the platform. The vulnerability aligns with CWE-79, which specifically addresses cross-site scripting flaws in web applications, and may be categorized under ATT&CK technique T1566 for social engineering and T1071 for application layer protocols. Organizations should also conduct comprehensive security assessments of their Tenable Security Center deployments, review access controls, and implement regular security audits to identify similar vulnerabilities in other security tools and applications within their environment.