Tenable Identity Exposure
Approved changes feed: RSS · Atom
cpe:2.3:a:tenable:tenable_identity_exposure:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Tenable (c0ec4e71-d667-5327-b3ed-b4c21aa5a87e) |
|---|---|
| Product | Tenable Identity Exposure (404b0ea3-ef72-5b83-ae2c-b1ab841a830a) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-13007 |
vulnerable | 2026-07-29 00:23:32.744248 |
Insecure Public Caching on REST API Endpoints in Tenable Identity Exposure
HIGH (7.5)
Tenable Identity Exposure contains multiple unauthenticated API endpoints under /w/api/* that expose sensitive application configuration data including cleartext LDAP credentials, SAML configuration, user accounts, and directory settings to unauthenticated remote attackers. Affected responses are served with Cache-Control: public headers and without Vary: Cookie, allowing reverse proxies and CDNs to cache and serve sensitive data to unauthenticated users even after authentication is applied.
Published: 2026-06-23T15:59:50.522Z
Updated: 2026-06-23T17:48:03.138Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-1091 |
vulnerable | 2026-06-08 07:06:36.907705 |
Broken Authorization Schema
MEDIUM (4.3)
A Broken Authorization schema exists where any authenticated user could download IOA script and configuration files if the URL is known.
Published: 2025-02-25T23:27:44.401Z
Updated: 2025-02-26T15:43:26.749Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-0760 |
vulnerable | 2026-06-08 07:02:25.510073 |
Stored Credential Disclosure Vulnerability
LOW (2.7)
A Credential Disclosure vulnerability exists where an administrator could extract the stored SMTP account credentials due to lack of encryption.
Published: 2025-02-25T23:31:24.292Z
Updated: 2025-02-26T15:43:21.203Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-3232 |
vulnerable | 2026-06-08 06:41:52.744122 |
Formula Injection Vulnerability
HIGH (7.6)
A formula injection vulnerability exists in Tenable Identity Exposure where an authenticated remote attacker with administrative privileges could manipulate application form fields in order to trick another administrator into executing CSV payloads. - CVE-2024-3232
Published: 2024-07-16T17:02:19.000Z
Updated: 2024-08-01T20:05:08.350Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.