Detections
Analytics
SCA: security update for request-filtering-agent (GHSA-pw25-c82r-75mm)
medium Tenable Self-Hosted Container Security Plugin ID 435095
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- request-filtering-agent is an http(s).Agent implementation that blocks requests to Private/Reserved IP
addresses. Versions 1.x.x and earlier contain a vulnerability where HTTPS requests to 127.0.0.1 bypass IP
address filtering, while HTTP requests are correctly blocked. This allows attackers to potentially access
internal HTTPS services running on localhost, bypassing the library's SSRF protection. The vulnerability
is particularly dangerous when the application accepts user-controlled URLs and internal services are only
protected by network-level restrictions. This vulnerability has been fixed in request-filtering-agent
version 2.0.0. Users should upgrade to version 2.0.0 or later. (CVE-2025-57814)
See Also
Plugin Details
Severity: Medium
ID: 435095
Version: Revision 1.12
Type: Local
Family: SCA Checks
Published: 8/26/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.3
Percentile: 53.2
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: Medium
Base Score: 6.4
Temporal Score: 4.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N
CVSS Score Source: CVE-2025-57814
CVSS v3
Risk Factor: Critical
Base Score: 9.1
Temporal Score: 7.9
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: Medium
Base Score: 6.9
Threat Score: 5.5
Threat Vector: CVSS:4.0/E:P
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 8/25/2025
Vulnerability Publication Date: 8/25/2025
Reference Information
CVE: CVE-2025-57814
cwe: CWE-918