Detections
Analytics

SCA: security update for org.hl7.fhir.publisher:org.hl7.fhir.publisher.cli, org.hl7.fhir.publisher:org.hl7.fhir.publisher.core (GHSA-6729-95v3-pjc2)

medium Tenable Cloud Security Plugin ID 420766

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - The HL7 FHIR IG publisher is a tool to take a set of inputs and create a standard FHIR IG. Prior to
 version 1.8.9, in CI contexts, the IG Publisher CLI uses git commands to determine the URL of the
 originating repo. If the repo was cloned, or otherwise set to use a repo that uses a username and
 credential based URL, the entire URL will be included in the built Implementation Guide, exposing username
 and credential. This does not impact users that clone public repos without credentials, such as those
 using the auto-ig-build continuous integration infrastructure. This problem has been patched in release
 1.8.9. Some workarounds are available. Users should ensure the IG repo they are publishing does not have
 username or credentials included in the `origin` URL. Running the command `git remote origin url` should
 return a URL that contains no username, password, or token; or users should run the IG Publisher CLI with
 the `-repo` parameter and specify a URL that contains no username, password, or token. (CVE-2025-24363)

See Also

https://github.com/advisories/GHSA-6729-95v3-pjc2

Plugin Details

Severity: Medium

ID: 420766

Version: Revision 1.12

Type: Local

Family: SCA Checks

Published: 1/25/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.92

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.2

Vector: CVSS2#AV:L/AC:L/Au:M/C:C/I:N/A:N

CVSS Score Source: CVE-2025-24363

CVSS v3

Risk Factor: Medium

Base Score: 4.2

Temporal Score: 3.7

Vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 1/24/2025

Vulnerability Publication Date: 1/24/2025

Reference Information

CVE: CVE-2025-24363

cwe: CWE-200