{"id":"CVE-2023-24493","aliases":["EUVD-2023-28511","GHSA-3c93-hfq2-f4vp"],"status":"published","title":"A formula injection vulnerability exists in Tenable.sc due to improper validation of user...","description":"A formula injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. An authenticated attacker could leverage the reporting system to export reports containing formulas, which would then require a victim to approve and execute on a host.","severity":{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.00747,"percentile":0.55355,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-20"],"published":"2023-01-25T00:00:00Z","modified":"2026-06-17T05:39:22Z","products":[{"vendor":"tenable","product":"tenable.sc"}],"references":[{"url":"https://www.tenable.com/security/tns-2023-03","tags":["x_transferred","Patch","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-24493"},{"url":"https://github.com/advisories/GHSA-3c93-hfq2-f4vp"}],"sources":{"cve":[{"id":"CVE-2023-24493","description":"A formula injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. An authenticated attacker could leverage the reporting system to export reports containing formulas, which would then require a victim to approve and execute on a host.","status":"published","published":"2023-01-25T00:00:00Z","modified":"2025-04-01T14:57:24.584Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:35:27.006218Z"}],"euvd":[{"id":"EUVD-2023-28511","description":"A formula injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. An authenticated attacker could leverage the reporting system to export reports containing formulas, which would then require a victim to approve and execute on a host.","status":"published","published":"2023-01-25T00:00:00Z","modified":"2025-04-01T14:57:24Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:45.844316Z"}],"ghsa":[{"id":"GHSA-3c93-hfq2-f4vp","title":"A formula injection vulnerability exists in Tenable.sc due to improper validation of user...","description":"A formula injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. An authenticated attacker could leverage the reporting system to export reports containing formulas, which would then require a victim to approve and execute on a host.","status":"published","published":"2023-01-26T21:30:17Z","modified":"2023-02-10T05:06:24Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:54:01.789224Z"}],"nvd":[{"id":"CVE-2023-24493","description":"A formula injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. An authenticated attacker could leverage the reporting system to export reports containing formulas, which would then require a victim to approve and execute on a host.","status":"published","published":"2023-01-26T21:18:19.403Z","modified":"2026-06-17T05:39:22.99Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:07:46.064662Z"}]}}