Detections
Analytics

SCA: security update for privatebin/privatebin (GHSA-mqqj-fx8h-437j)

medium Tenable Cloud Security Plugin ID 417098

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - PrivateBin is an online pastebin where the server has zero knowledge of pasted data. In v1.5, PrivateBin
 introduced the YOURLS server-side proxy. The idea was to allow using the YOURLs URL shortener without
 running the YOURLs instance without authentication and/or exposing the authentication token to the public,
 allowing anyone to shorten any URL. With the proxy mechanism, anyone can shorten any URL pointing to the
 configured PrivateBin instance. The vulnerability allowed other URLs to be shortened, as long as they
 contain the PrivateBin instance, defeating the limit imposed by the proxy. This vulnerability is fixed in
 1.7.4. (CVE-2024-39899)

See Also

https://github.com/advisories/GHSA-mqqj-fx8h-437j

Plugin Details

Severity: Medium

ID: 417098

Version: Revision 1.5

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2024-39899

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6.9

Threat Score: 2.7

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 7/10/2024

Vulnerability Publication Date: 7/9/2024

Reference Information

CVE: CVE-2024-39899