Detections
Analytics
SCA: security update for rasa, rasa-pro (GHSA-cpv4-ggrr-7j9v)
critical Tenable Self-Hosted Container Security Plugin ID 414007
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Open source machine learning framework. A vulnerability has been identified in Rasa that enables an
attacker who has the ability to load a maliciously crafted model remotely into a Rasa instance to achieve
Remote Code Execution. The prerequisites for this are: 1. The HTTP API must be enabled on the Rasa
instance eg with `--enable-api`. This is not the default configuration. 2. For unauthenticated RCE to be
exploitable, the user must not have configured any authentication or other security controls recommended
in our documentation. 3. For authenticated RCE, the attacker must posses a valid authentication token or
JWT to interact with the Rasa API. This issue has been addressed in rasa version 3.6.21 and all users are
advised to upgrade. Users unable to upgrade should ensure that they require authentication and that only
trusted users are given access. (CVE-2024-49375)
See Also
Plugin Details
Severity: Critical
ID: 414007
Version: Revision 1.11
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 5
Percentile: 94.59
Vendor
Vendor Severity: Critical
CVSS v2
Risk Factor: High
Base Score: 7.6
Temporal Score: 5.6
Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2024-49375
CVSS v3
Risk Factor: Critical
Base Score: 9
Temporal Score: 7.8
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 1/14/2025
Vulnerability Publication Date: 1/14/2025
Reference Information
CVE: CVE-2024-49375