Vulnerability · Published Jun 6, 2023 · Assigned by canonical
CVE-2023-32550Landscape's Apache server-status is accessible by default
Critical 9.3
In plain English
A critical-severity security flaw in Landscape from Canonical Ltd.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).
Severity (CVSS 3.1)9.3Critical
Exploit odds (30 days)0.4%top 60.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Landscape's server-status page exposed sensitive system information. This data leak included GET requests which contain information to attack and leak further information from the Landscape API.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Canonical Ltd. | Landscape | 0 – before 19.10.05 |
Weakness: CWE-497 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
References
- https://bugs.launchpad.net/landscape/+bug/1929037 issue-tracking