Описание
Miniflux is a feed reader. Prior to version 2.0.43, an unauthenticated user can retrieve Prometheus metrics from a publicly reachable Miniflux instance where the METRICS_COLLECTOR configuration option is enabled and METRICS_ALLOWED_NETWORKS is set to 127.0.0.1/8 (the default). A patch is available in Miniflux 2.0.43. As a workaround, set METRICS_COLLECTOR to false (default) or run Miniflux behind a trusted reverse-proxy.
Ссылки
- Issue TrackingPatch
- Release Notes
- Vendor Advisory
- Product
- Issue TrackingPatch
- Release Notes
- Vendor Advisory
- Product
Уязвимые конфигурации
Конфигурация 1Версия до 2.0.43 (исключая)
cpe:2.3:a:miniflux_project:miniflux:*:*:*:*:*:go:*:*
EPSS
Процентиль: 52%
0.00289
Низкий
7.5 High
CVSS3
Дефекты
CWE-200
NVD-CWE-noinfo
Связанные уязвимости
CVSS3: 7.5
github
10 месяцев назад
Unauthenticated Miniflux user can bypass allowed networks check to obtain Prometheus metrics
EPSS
Процентиль: 52%
0.00289
Низкий
7.5 High
CVSS3
Дефекты
CWE-200
NVD-CWE-noinfo