This vulnerability involves improper neutralization of special elements used in an SQL command within Tenable Nessus. An attacker can create a malicious scan result file that, upon import by a privileged user, executes injected SQL commands against the scan results database. The vulnerability has a CVSS 3.1 base score of 3.3, indicating low severity, with attack vector local, low complexity, no privileges required, and user interaction required. The impact is limited to confidentiality with no integrity or availability impact. An official patch is available to address this issue.

The vulnerability allows potential exfiltration of scan-result data from the Nessus database due to SQL injection. However, the impact is limited to confidentiality (partial data disclosure) with no impact on integrity or availability. Exploitation requires a privileged user to import a crafted scan result file and user interaction, reducing the likelihood of exploitation.

An official fix is available for this vulnerability. It is recommended to apply the vendor-provided patch promptly to remediate the issue. Since the vulnerability requires importing a malicious scan result file by a privileged user, restricting import sources and validating scan files before import can reduce risk until patched.