Detections
Analytics

SCA: security update for d7y.io/dragonfly/v2 (GHSA-hpc8-7wpm-889w)

critical Tenable Self-Hosted Container Security Plugin ID 415858

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Dragonfly is an open source P2P-based file distribution and image acceleration system. It is hosted by the
 Cloud Native Computing Foundation (CNCF) as an Incubating Level Project. Dragonfly uses JWT to verify
 user. However, the secret key for JWT, "Secret Key", is hard coded, which leads to authentication bypass.
 An attacker can perform any action as a user with admin privileges. This issue has been addressed in
 release version 2.0.9. All users are advised to upgrade. There are no known workarounds for this
 vulnerability. (CVE-2023-27584)

See Also

https://github.com/advisories/GHSA-hpc8-7wpm-889w

Plugin Details

Severity: Critical

ID: 415858

Version: Revision 1.8

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.58

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2023-27584

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: Critical

Base Score: 9.3

Threat Score: 8.9

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 9/19/2024

Vulnerability Publication Date: 9/19/2024

Reference Information

CVE: CVE-2023-27584