Detections
Analytics

SCA: security update for github.com/dapr/dapr (GHSA-59m6-82qm-vqgj)

high Tenable Self-Hosted Container Security Plugin ID 410739

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. A
 vulnerability has been found in Dapr that allows bypassing API token authentication, which is used by the
 Dapr sidecar to authenticate calls coming from the application, with a well-crafted HTTP request. Users
 who leverage API token authentication are encouraged to upgrade Dapr to 1.10.9 or to 1.11.2. This
 vulnerability impacts Dapr users who have configured API token authentication. An attacker could craft a
 request that is always allowed by the Dapr sidecar over HTTP, even if the `dapr-api-token` in the request
 is invalid or missing. The issue has been fixed in Dapr 1.10.9 or to 1.11.2. There are no known
 workarounds for this vulnerability. (CVE-2023-37918)

See Also

https://github.com/advisories/GHSA-59m6-82qm-vqgj

Plugin Details

Severity: High

ID: 410739

Version: Revision 1.7

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.51

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2023-37918

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 7/21/2023

Vulnerability Publication Date: 7/21/2023

Reference Information

CVE: CVE-2023-37918