Detections
Analytics

SCA: security update for hemmelig (GHSA-vvxf-wj5w-6gj5)

medium Tenable Cloud Security Plugin ID 436515

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Hemmelig is a messing app with with client-side encryption and self-destructing messages. Prior to version
 7.3.3, a Server-Side Request Forgery (SSRF) filter bypass vulnerability exists in the webhook URL
 validation of the Secret Requests feature. The application attempts to block internal/private IP addresses
 but can be bypassed using DNS rebinding or open redirect services. This allows an authenticated user to
 make the server initiate HTTP requests to internal network resources. Version 7.3.3 contains a patch for
 the issue. (CVE-2025-69206)

See Also

https://github.com/advisories/GHSA-vvxf-wj5w-6gj5

Plugin Details

Severity: Medium

ID: 436515

Version: Revision 1.8

Type: Local

Family: SCA Checks

Published: 12/30/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 4

Temporal Score: 3.1

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS Score Source: CVE-2025-69206

CVSS v3

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.9

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 12/29/2025

Vulnerability Publication Date: 12/29/2025

Reference Information

CVE: CVE-2025-69206

cwe: CWE-918