CVE-2019-12105

Description

In Supervisor through 4.0.2, an unauthenticated user can read log files or restart a service. Note: The maintainer responded that the affected component, inet_http_server, is not enabled by default but if the user enables it and does not set a password, Supervisor logs a warning message. The maintainer indicated the ability to run an open server will not be removed but an additional warning was added to the documentation

Risk Information

Base Score

8.2

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

EPSS Score

Exploitation Probability

1.812

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2019-12105 are fixed in Python-supervisor 4.0.3	Windows
Vulnerabilities CVE-2019-12105 are fixed in Python-supervisor for linux 4.0.3	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234