CVE-2018-1148 : Security Advisory and Response

This CVE-2018-1148 article provides insights into a vulnerability in Tenable Nessus prior to version 7.1.0, leading to Session Fixation.

Understanding CVE-2018-1148

This CVE involves insufficient session management in Tenable Nessus, allowing attackers to maintain access post-password change.

What is CVE-2018-1148?

Session Fixation vulnerability in Tenable Nessus before version 7.1.0
Attackers with authentication privileges can retain system access after a user changes their password

The Impact of CVE-2018-1148

Allows attackers to sustain access to the system even after a password change

Technical Details of CVE-2018-1148

This section delves into the technical aspects of the vulnerability.

Vulnerability Description

Insufficient session management in Tenable Nessus
Presence of Session Fixation before version 7.1.0

Affected Systems and Versions

Product: Tenable Nessus
Vendor: Tenable
Versions Affected: All versions prior to 7.1.0

Exploitation Mechanism

Attackers with authentication privileges exploit the session fixation vulnerability

Mitigation and Prevention

Guidelines to address and prevent the CVE-2018-1148 vulnerability.

Immediate Steps to Take

Update Tenable Nessus to version 7.1.0 or later
Monitor system access for any suspicious activities

Long-Term Security Practices

Implement strong password policies
Conduct regular security audits and assessments

Patching and Updates

Regularly apply security patches and updates to Tenable Nessus