CVE-2023-27591

Summary

Miniflux is a feed reader. Prior to version 2.0.43, an unauthenticated user can retrieve Prometheus metrics from a publicly reachable Miniflux instance where the METRICS_COLLECTOR configuration option is enabled and METRICS_ALLOWED_NETWORKS is set to 127.0.0.1/8 (the default). A patch is available in Miniflux 2.0.43. As a workaround, set METRICS_COLLECTOR to false (default) or run Miniflux behind a trusted reverse-proxy.

Affected Software

Weaknesses

• CWE-1220: CWE-1220: Insufficient Granularity of Access Control
• CWE-200: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

ADP Enrichment

CVE Program Container

Additional References

• https://github.com/miniflux/v2/security/advisories/GHSA-3qjf-qh38-x73v
• https://github.com/miniflux/v2/pull/1745
• https://github.com/miniflux/v2/releases/tag/2.0.43
• https://miniflux.app/docs/configuration.html#metrics-collector

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: partial

References

• https://github.com/miniflux/v2/security/advisories/GHSA-3qjf-qh38-x73v
• https://github.com/miniflux/v2/pull/1745
• https://github.com/miniflux/v2/releases/tag/2.0.43
• https://miniflux.app/docs/configuration.html#metrics-collector

• ←Previous
• Next→