Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2023-27591

Date: March 17, 2023

Miniflux is a feed reader. Prior to version 2.0.43, an unauthenticated user can retrieve Prometheus metrics from a publicly reachable Miniflux instance where the "METRICS_COLLECTOR" configuration option is enabled and "METRICS_ALLOWED_NETWORKS" is set to "127.0.0.1/8" (the default). A patch is available in Miniflux 2.0.43. As a workaround, set "METRICS_COLLECTOR" to "false" (default) or run Miniflux behind a trusted reverse-proxy.

Language: Go

Severity Score

Related Resources (7)

https://github.com/miniflux/v2/pull/1745
https://github.com/miniflux/v2/releases/tag/2.0.43
https://miniflux.app/docs/configuration.html#metrics-collector
https://github.com/miniflux/v2
https://nvd.nist.gov/vuln/detail/CVE-2023-27591
https://github.com/miniflux/v2/security/advisories/GHSA-3qjf-qh38-x73v
https://www.mend.io/vulnerability-database/CVE-2023-27591

Severity Score

Weakness Type (CWE)

Exposure of Sensitive Information to an Unauthorized Actor

CWE-200

Insufficient Information

NVD-CWE-noinfo

Insufficient Granularity of Access Control

CWE-1220

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): NONE
Availability (A): NONE

Do you need more information?

Contact Us