Detections
Analytics

SCA: security update for ethyca-fides (GHSA-rpw8-82v9-3q87)

medium Tenable Cloud Security Plugin ID 435220

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Fides is an open-source privacy engineering platform. Prior to version 2.69.1, admin UI user password
 changes in Fides do not invalidate active user sessions, creating a vulnerability chaining opportunity
 where attackers who have obtained session tokens through other attack vectors (such as XSS) can maintain
 access even after password reset. This issue is not directly exploitable on its own and requires a
 prerequisite vulnerability to obtain valid session tokens in the first place. Version 2.69.1 fixes the
 issue. No known workarounds are available. (CVE-2025-57766)

See Also

https://github.com/advisories/GHSA-rpw8-82v9-3q87

Plugin Details

Severity: Medium

ID: 435220

Version: Revision 1.203

Type: Local

Family: SCA Checks

Published: 9/8/2025

Updated: 7/1/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 2.1

Percentile: 7.51

Vendor

Vendor Severity: Low

CVSS v2

Risk Factor: Medium

Base Score: 4

Temporal Score: 3.1

Vector: CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2025-57766

CVSS v3

Risk Factor: Medium

Base Score: 4.8

Temporal Score: 4.3

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6.3

Threat Score: 1.7

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 9/8/2025

Vulnerability Publication Date: 9/8/2025

Reference Information

CVE: CVE-2025-57766

cwe: CWE-613