CVE-2019-12105 Missing authorization in n/a
Unauthenticated users can read logs or restart services if the inet_http_server is enabled without a password.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-12105?
CVE-2019-12105 is a high-severity missing authorization vulnerability in n/a, published on 10 Sep 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Supervisor through 4.0.2, an unauthenticated user can read log files or restart a service. Note: The maintainer responded that the affected component, inet_http_server, is not enabled by default but if the user enables it and does not set a password, Supervisor logs a warning message. The maintainer indicated the ability to run an open server will not be removed but an additional warning was added to the documentation
Weakness: CWE-306
Which versions are affected by CVE-2019-12105?
1 open source package ship an affected version, including supervisor. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
supervisor PyPI | All versions | 4.0.3 |
Linux distribution packages (1)
supervisor openSUSE:Tumbleweed | All versions | 4.1.0-1.8 |
Products include Supervisord Supervisor.
How do I fix CVE-2019-12105?
Upgrade supervisor to 4.0.3 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2019-12105 being exploited?
There is no known exploitation of CVE-2019-12105 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2019-12105, DEBIAN-CVE-2019-12105, ECHO-7c49-586a-06bd, GHSA-6x94-2xr2-xgw3, PYSEC-2019-126, openSUSE-SU-2024:11414-1.