Tenable Identity Exposure Credential Disclosure Vulnerability

A credential disclosure vulnerability exists in Tenable Identity Exposure versions through 3.77.8, allowing administrators to extract stored SMTP account credentials due to a lack of encryption. This vulnerability could be exploited by accessing the application with administrative privileges and retrieving the unencrypted credentials.

Impact

Exploitation of this vulnerability could lead to unauthorized access to SMTP account credentials, potentially allowing for misuse of email functionalities or impersonation.

Remediation

Tenable has released version 3.77.9, which addresses this vulnerability. The update can be downloaded from the Tenable Downloads Portal.