This vulnerability in Tenable Nessus involves improper neutralization of special elements used in SQL commands, enabling SQL injection. An attacker can create a malicious scan result file that, upon import by a privileged user, executes injected SQL within the scan results database. The CVSS 3.1 base score is 3.3, reflecting low impact with local attack vector, low complexity, no privileges required, and user interaction needed. The vendor has released an official fix to remediate this issue.

Successful exploitation could allow an attacker to exfiltrate scan-result data from the Nessus database. The impact is limited to confidentiality with no impact on integrity or availability. The attack requires a privileged user to import a crafted scan result file, and user interaction is necessary.

An official fix is available from the vendor to address this vulnerability. Users should apply the vendor's patch promptly to remediate the issue. Since this is not a cloud service, remediation depends on user action to update Nessus installations.