mitmproxy is a interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers and mitmweb is a web-based interface for mitmproxy. In mitmweb 11.1.1 and below, a malicious client can use mitmweb's proxy server (bound to `*:8080` by default) to access mitmweb's internal API (bound to `127.0.0.1:8081` by default). In other words, while the cannot access the API directly, they can access the API through the proxy. An attacker may be able to escalate this SSRF-style access to remote code execution. The mitmproxy and mitmdump tools are unaffected. Only mitmweb is affected. This vulnerability has been fixed in mitmproxy 11.1.2 and above. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - mitmproxy is a interactive TLS-capable intercepting HTTP proxy for penetration testers and software     developers and mitmweb is a web-based interface for mitmproxy. In mitmweb 11.1.1 and below, a malicious     client can use mitmweb's proxy server (bound to `*:8080` by default) to access mitmweb's internal API     (bound to `127.0.0.1:8081` by default). In other words, while the cannot access the API directly, they can     access the API through the proxy. An attacker may be able to escalate this SSRF-style access to remote     code execution. The mitmproxy and mitmdump tools are unaffected. Only mitmweb is affected. This     vulnerability has been fixed in mitmproxy 11.1.2 and above. Users are advised to upgrade. There are no     known workarounds for this vulnerability. (CVE-2025-23217)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - mitmproxy is a interactive TLS-capable intercepting HTTP proxy for penetration testers and software
    developers and mitmweb is a web-based interface for mitmproxy. In mitmweb 11.1.1 and below, a malicious
    client can use mitmweb's proxy server (bound to `*:8080` by default) to access mitmweb's internal API
    (bound to `127.0.0.1:8081` by default). In other words, while the cannot access the API directly, they can
    access the API through the proxy. An attacker may be able to escalate this SSRF-style access to remote
    code execution. The mitmproxy and mitmdump tools are unaffected. Only mitmweb is affected. This
    vulnerability has been fixed in mitmproxy 11.1.2 and above. Users are advised to upgrade. There are no
    known workarounds for this vulnerability. (CVE-2025-23217)

ID	Name	Product	Family	Type	Severity
257508	Linux Distros Unpatched Vulnerability : CVE-2025-23217	Nessus	Misc.	Local	high
420839	SCA: security update for mitmproxy (GHSA-wg33-5h85-7q5p)	Tenable Cloud Security	SCA Checks	Local	high
420839	SCA: security update for mitmproxy (GHSA-wg33-5h85-7q5p)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2025-23217

high

Tenable Plugins

high

high

high