CVE-2023-27591

HIGH EPSS 50.5%
Published Mar 17, 20233y ago · Modified Jun 17, 20262w ago
7.5 CVSS 3.1
High
Find Similar
Published Mar 17, 2023 3y ago
Last Modified Jun 17, 2026 2w ago

Description

Miniflux is a feed reader. Prior to version 2.0.43, an unauthenticated user can retrieve Prometheus metrics from a publicly reachable Miniflux instance where the `METRICS_COLLECTOR` configuration option is enabled and `METRICS_ALLOWED_NETWORKS` is set to `127.0.0.1/8` (the default). A patch is available in Miniflux 2.0.43. As a workaround, set `METRICS_COLLECTOR` to `false` (default) or run Miniflux behind a trusted reverse-proxy.

CVSS Details

Base Score
7.5
Exploitability
3.9
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
50.5% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 2

CWE-1220
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Information Exposure

Affected Products 1

VendorProductVersionRange
miniflux_projectminiflux* <2.0.43

References 4

  • github.com https://github.com/miniflux/v2/pull/1745
    Issue TrackingPatch
  • github.com https://github.com/miniflux/v2/releases/tag/2.0.43
    Release Notes
  • github.com https://github.com/miniflux/v2/security/advisories/GHSA-3qjf-qh38-x73v
    Vendor Advisory
  • miniflux.app https://miniflux.app/docs/configuration.html#metrics-collector
    Product

Remediation

  • github.com https://github.com/miniflux/v2/pull/1745
    Issue TrackingPatch