Vulnerability · Published Mar 17, 2023 · Assigned by GitHub_M

CVE-2023-27591Unauthenticated Miniflux user can bypass allowed networks check to obtain Prometheus metrics

High 7.5

In plain English

A high-severity information exposure in v2 from miniflux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.8%top 44.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Miniflux is a feed reader. Prior to version 2.0.43, an unauthenticated user can retrieve Prometheus metrics from a publicly reachable Miniflux instance where the `METRICS_COLLECTOR` configuration option is enabled and `METRICS_ALLOWED_NETWORKS` is set to `127.0.0.1/8` (the default). A patch is available in Miniflux 2.0.43. As a workaround, set `METRICS_COLLECTOR` to `false` (default) or run Miniflux behind a trusted reverse-proxy.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	miniflux.app	no fix listed	GHSA-3qjf-qh38-x73v
Go	miniflux.app/v2	2.0.43	GHSA-3qjf-qh38-x73v

Affected products (as reported)

Vendor	Product	Versions
miniflux	v2	< 2.0.43

Weakness: CWE-1220, CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/miniflux/v2/security/advisories/GHSA-3qjf-qh38-x73v x_refsource_CONFIRM
https://github.com/miniflux/v2/pull/1745 x_refsource_MISC
https://github.com/miniflux/v2/releases/tag/2.0.43 x_refsource_MISC
https://miniflux.app/docs/configuration.html#metrics-collector x_refsource_MISC