CVE-2023-30797
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Summary
Netflix Lemur before version 1.3.2 used insufficiently random values when generating default credentials. The insufficiently random values may allow an attacker to guess the credentials and gain access to resources managed by Lemur.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Netflix | Lemur | 0 < 1.3.2 | affected |
Weaknesses
- CWE-330: CWE-330 Use of Insufficiently Random Values
ADP Enrichment
CVE Program Container
Additional References
- https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2023-001.md
- https://github.com/Netflix/lemur/commit/666d853212174ee7f4e6f8b3b4b389ede1872238
- https://github.com/Netflix/lemur/security/advisories/GHSA-5fqv-mpj8-h7gm
- https://vulncheck.com/advisories/netflix-lemur-weak-rng
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: yes
- Technical Impact: partial
References
- https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2023-001.md
- https://github.com/Netflix/lemur/commit/666d853212174ee7f4e6f8b3b4b389ede1872238
- https://github.com/Netflix/lemur/security/advisories/GHSA-5fqv-mpj8-h7gm
- https://vulncheck.com/advisories/netflix-lemur-weak-rng
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.