Go/miniflux.app CVE-2023-27591: high 7.5, EPSS 0.76%
Unauthenticated Miniflux user can bypass allowed networks check to obtain Prometheus metrics
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 1.0.46 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-3qjf-qh38-x73v#Go/miniflux.app
- https://github.com/miniflux/v2/security/advisories/GHSA-3qjf-qh38-x73v
- https://nvd.nist.gov/vuln/detail/CVE-2023-27591
- https://github.com/miniflux/v2/pull/1745
- https://github.com/miniflux/v2
- https://github.com/miniflux/v2/releases/tag/2.0.43
- https://miniflux.app/docs/configuration.html#metrics-collector
CVE-2023-27591 · published · modified · JSON