Detections
Analytics
SCA: security update for Umbraco.Cms.Api.Delivery (GHSA-75vq-qvhr-7ffr)
medium Tenable Self-Hosted Container Security Plugin ID 428671
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Umbraco is an ASP.NET CMS. In versions 13.0.0 through 13.9.2, 15.0.0 through 15.4.1 and 16.0.0 through
16.1.0, the content delivery API can be restricted from public access where an API key must be provided in
a header to authorize the request. It's also possible to configure output caching, such that the delivery
API outputs will be cached for a period of time, improving performance. There's an issue when these two
things are used together, where caching doesn't vary by the header that contains the API key. As such,
it's possible for a user without a valid API key to retrieve a response for a given path and query if it
has recently been requested and cached by request with a valid key. This is fixed in versions 13.9.3,
15.4.4 and 16.1.1. (CVE-2025-54425)
See Also
Plugin Details
Severity: Medium
ID: 428671
Version: Revision 1.9
Type: Local
Family: SCA Checks
Published: 7/30/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 1.2
Percentile: 0.01
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS Score Source: CVE-2025-54425
CVSS v3
Risk Factor: Medium
Base Score: 5.3
Temporal Score: 4.6
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 7/29/2025
Vulnerability Publication Date: 7/29/2025
Reference Information
CVE: CVE-2025-54425
cwe: CWE-200