Detections
Analytics

SCA: security update for ethyca-fides (GHSA-fq34-xw6c-fphf)

medium Tenable Self-Hosted Container Security Plugin ID 435218

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Fides is an open-source privacy engineering platform. Prior to version 2.69.1, the Fides Webserver API's
 built-in IP-based rate limiting is ineffective in environments with CDNs, proxies or load balancers. The
 system incorrectly applies rate limits based on directly connected infrastructure IPs rather than client
 IPs, and stores counters in-memory rather than in a shared store. This allows attackers to bypass intended
 rate limits and potentially cause denial of service. This vulnerability only affects deployments relying
 on Fides's built-in rate limiting for protection. Deployments using external rate limiting solutions
 (WAFs, API gateways, etc.) are not affected. Version 2.69.1 fixes the issue. There are no application-
 level workarounds. However, rate limiting may instead be implemented externally at the infrastructure
 level using a WAF, API Gateway, or similar technology. (CVE-2025-57816)

See Also

https://github.com/advisories/GHSA-fq34-xw6c-fphf

Plugin Details

Severity: Medium

ID: 435218

Version: Revision 1.9

Type: Local

Family: SCA Checks

Published: 9/8/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.51

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2025-57816

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6.3

Threat Score: 1.7

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/8/2025

Vulnerability Publication Date: 9/8/2025

Reference Information

CVE: CVE-2025-57816