There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3. A vulnerability has been identified
    in the authentication and authorization process of the endpoint responsible for altering the metadata of
    an emergency access. It permits an attacker with granted emergency access to escalate their privileges by
    changing the access level and modifying the wait time. Consequently, the attacker can gain full control
    over the vault (when only intended to have read access) while bypassing the necessary wait period.
    (CVE-2024-39924)

  - An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3. It lacks an offboarding process for
    members who leave an organization. As a result, the shared organization key is not rotated when a member
    departs. Consequently, the departing member, whose access should be revoked, retains a copy of the
    organization key. Additionally, the application fails to adequately protect some encrypted data stored on
    the server. Consequently, an authenticated user could gain unauthorized access to encrypted data of any
    organization, even if the user is not a member of the targeted organization. However, the user would need
    to know the corresponding organizationId. Hence, if a user (whose access to an organization has been
    revoked) already possesses the organization key, that user could use the key to decrypt the leaked data.
    (CVE-2024-39925)

  - An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3. A stored cross-site scripting (XSS)
    or, due to the default CSP, HTML injection vulnerability has been discovered in the admin dashboard. This
    potentially allows an authenticated attacker to inject malicious code into the dashboard, which is then
    executed or rendered in the context of an administrator's browser when viewing the injected content.
    However, it is important to note that the default Content Security Policy (CSP) of the application blocks
    most exploitation paths, significantly mitigating the potential impact. (CVE-2024-39926)

リモートホストにインストールされている FreeBSD のバージョンは、テスト済みバージョンより前です。したがって、d2723b0f-58d9-11ef-b611-84a93843eb75 のアドバイザリに記載されている複数の脆弱性の影響を受けます。

    SO-AND-SO による報告:
    このリリースでは複数の CVE レポートが修正されているため、できるだけ早く最新のバージョンに更新することを推奨します。

Tenable は、前述の記述ブロックを FreeBSD セキュリティアドバイザリから直接抽出しています。

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the d2723b0f-58d9-11ef-b611-84a93843eb75 advisory.

    SO-AND-SO reports:
    This release has several CVE Reports fixed and we recommend                 everybody to update to the latest version as soon as possible.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
427538	Alpine: multiple vaultwarden packages: security update to 1.32.0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2025/5/16	2026/7/2	high
426539	Alpine: multiple vaultwarden packages: security update to 1.32.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2025/5/16	2026/7/2	high
427538	Alpine: multiple vaultwarden packages: security update to 1.32.0	Tenable Cloud Security	Alpine Linux Local Security Checks	2025/5/16	2026/7/2	high
426539	Alpine: multiple vaultwarden packages: security update to 1.32.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	2025/5/16	2026/7/2	high
205436	FreeBSD : Vaultwarden -- 複数の脆弱性 (d2723b0f-58d9-11ef-b611-84a93843eb75)	Nessus	FreeBSD Local Security Checks	2024/8/13	2025/6/4	high
205436	FreeBSD : Vaultwarden -- Multiple vulnerabilities (d2723b0f-58d9-11ef-b611-84a93843eb75)	Nessus	FreeBSD Local Security Checks	2024/8/13	2025/6/4	high

検出

プラグインの検索

high

high

high

high

high

high