CVE-2023-32550 Landscape's Apache server-status is accessible by default

Critical 9.3 Published 6 Jun 2023 Updated 7 Jan 2025

Attackers can access the Apache server-status page to leak sensitive system information and API details from Landscape.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-32550?

CVE-2023-32550 is a critical vulnerability in Canonical Ltd. Landscape, published on 6 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Landscape's server-status page exposed sensitive system information. This data leak included GET requests which contain information to attack and leak further information from the Landscape API.

Weakness: CWE-668, CWE-497

Which versions are affected by CVE-2023-32550?

It affects 1 product.

Products include Canonical Landscape.

How do I fix CVE-2023-32550?

No fix has been published for CVE-2023-32550 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-32550 being exploited?

There is no known exploitation of CVE-2023-32550 in the wild and no public exploit code.

Sources

Also known as GHSA-qx9h-hx3f-jr6w.