Detections
Analytics

SCA: security update for Hangfire.Core (GHSA-7rq6-7gv8-c37h)

high Tenable Self-Hosted Container Security Plugin ID 412253

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Hangfire is an open source system to perform background job processing in a .NET or .NET Core
 applications. No Windows Service or separate process required. Dashboard UI in Hangfire.Core uses
 authorization filters to protect it from showing sensitive data to unauthorized users. By default when no
 custom authorization filters specified, `LocalRequestsOnlyAuthorizationFilter` filter is being used to
 allow only local requests and prohibit all the remote requests to provide sensible, protected by default
 settings. However due to the recent changes, in version 1.7.25 no authorization filters are used by
 default, allowing remote requests to succeed. If you are using `UseHangfireDashboard` method with default
 `DashboardOptions.Authorization` property value, then your installation is impacted. If any other
 authorization filter is specified in the `DashboardOptions.Authorization` property, the you are not
 impacted. Patched versions (1.7.26) are available both on Nuget.org and as a tagged release on the github
 repo. Default authorization rules now prohibit remote requests by default again by including the
 `LocalRequestsOnlyAuthorizationFilter` filter to the default settings. Please upgrade to the newest
 version in order to mitigate the issue. For users who are unable to upgrade it is possible to mitigate the
 issue by using the `LocalRequestsOnlyAuthorizationFilter` explicitly when configuring the Dashboard UI.
 (CVE-2021-41238)

See Also

https://github.com/advisories/GHSA-7rq6-7gv8-c37h

Plugin Details

Severity: High

ID: 412253

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 6/1/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2021-41238

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 11/3/2021

Vulnerability Publication Date: 11/2/2021

Reference Information

CVE: CVE-2021-41238

cwe: CWE-862