A critical SQL injection vulnerability in Tenable Security Center could allow an authenticated attacker to exfiltrate sensitive data from the underlying database.

This is a SQL injection vulnerability (CWE-89) arising from the improper neutralization of special elements in SQL commands. The CVSS vector indicates that this flaw requires low privileges (PR:L) to execute, meaning an authenticated user can perform unauthorized database queries.

Successful exploitation of this vulnerability could lead to significant data compromise, as an attacker may gain unauthorized access to sensitive information stored within the Security Center database. With a CVSS score of 7.1, this flaw is categorized as High severity, necessitating prompt remediation to prevent potential data breaches and maintain the integrity of security management infrastructure.

Immediate Action: Upgrade to Tenable Security Center version 6.9.0 or later, which is available via the Tenable Downloads Portal.

Proactive Monitoring: Review database access logs for unusual query patterns or unexpected SQL syntax that may indicate automated injection attempts.

Compensating Controls: Implement Web Application Firewall (WAF) rules designed to detect and block common SQL injection payloads targeted at the application interface.

Public Exploit Available: No

Given the potential for unauthorized data access, administrators should prioritize updating to version 6.9.0. Applying this patch is the only definitive way to neutralize the vulnerability and prevent exploitation by malicious actors.