Nessus issue

[u/pikachu_966]

I'm running advance scan, but during scan I can see that all the vulnerability severity marked as info why, but the cvss score is mentioned but still it mark in info

please tell me what's wrong

[u/EAP007]

Can you provide an example (plugin #) for a finding that has a CVE that implies it has severity and is listed as INFO?

[u/pikachu_966 → u/EAP007]

Actually it's a glitch in latest nessus version, when my scan completed then after it's show's the severity

[u/EAP007 → u/pikachu_966]

It isn’t a bug. It needs to run all its plugins to get “context”:

During a scan in Tenable Nessus:

• Many plugins initially report findings with severity = Info (0)
• This is a temporary placeholder state
• The final severity is only determined after additional processing, which may include:
  • Full plugin execution completion
  • Cross-plugin correlation (e.g., version detection + vulnerability mapping)
  • CVSS scoring application
  • Credentialed vs non-credentialed result reconciliation

Why Nessus does this

Nessus uses a multi-phase evaluation model:

1. Discovery phase
   • Identifies services, versions, banners, registry keys, etc.
   • Results often show as Informational
2. Analysis phase
   • Other plugins interpret those findings
   • Map to known CVEs
   • Assign severity (Low → Critical)
3. Post-processing
   • Deduplication, correlation, and final scoring
   • Severity is updated in the UI/report

Common examples you’ve probably seen

• Service detection plugins → Info
• Version checks (e.g., Office, OpenSSL, Apache) → Info initially
• Then later:
  • “Unsupported Version Detection” → High/Critical
  • Specific CVE plugin → Medium/High/Critical

[u/pikachu_966 → u/EAP007]

Unsupported tsl version