CVE-2023-32550 - Vulnerability Details - OpenCVE

Landscape's server-status page exposed sensitive system information. This data leak included GET requests which contain information to attack and leak further information from the Landscape API.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Canonical	Landscape

Configuration 1 [-]

cpe:2.3:a:canonical:landscape:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://bugs.launchpad.net/landscape/+bug/1929037

History

Tue, 07 Jan 2025 18:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: canonical

Published: 2023-06-06T15:07:42.162Z

Updated: 2025-01-07T18:01:11.352Z

Reserved: 2023-05-09T17:35:10.663Z

Link: CVE-2023-32550

Vulnrichment

Updated: 2024-08-02T15:18:37.652Z

NVD

Status : Modified

Published: 2023-06-06T16:15:10.687

Modified: 2024-11-21T08:03:34.880

Link: CVE-2023-32550

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-32550", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "state": "PUBLISHED", "assignerShortName": "canonical", "dateReserved": "2023-05-09T17:35:10.663Z", "datePublished": "2023-06-06T15:07:42.162Z", "dateUpdated": "2025-01-07T18:01:11.352Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://launchpad.net/landscape/", "packageName": "landscape", "platforms": ["Linux"], "product": "Landscape", "vendor": "Canonical Ltd.", "versions": [{"status": "affected", "version": "0", "lessThan": "19.10.05", "versionType": "commit"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Anton Ivanov"}], "datePublic": "2021-08-11T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "Landscape's server-status page exposed sensitive system information. This data leak included GET requests which contain information to attack and leak further information from the Landscape API."}], "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseSeverity": "CRITICAL", "baseScore": 9.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N"}, "format": "CVSS"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-497", "description": "CWE-497", "lang": "en", "type": "CWE"}]}], "references": [{"tags": ["issue-tracking"], "url": "https://bugs.launchpad.net/landscape/+bug/1929037"}], "title": "Landscape's Apache server-status is accessible by default", "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2023-06-06T15:07:42.162Z"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T15:18:37.652Z"}, "title": "CVE Program Container", "references": [{"tags": ["issue-tracking", "x_transferred"], "url": "https://bugs.launchpad.net/landscape/+bug/1929037"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-01-07T18:00:54.992790Z", "id": "CVE-2023-32550", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-07T18:01:11.352Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://bugs.launchpad.net/landscape/+bug/1929037", "tags": ["issue-tracking", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T15:18:37.652Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-32550", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-07T18:00:54.992790Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-07T18:01:03.417Z"}}], "cna": {"title": "Landscape's Apache server-status is accessible by default", "credits": [{"lang": "en", "type": "finder", "value": "Anton Ivanov"}], "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.3, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Canonical Ltd.", "product": "Landscape", "versions": [{"status": "affected", "version": "0", "lessThan": "19.10.05", "versionType": "commit"}], "platforms": ["Linux"], "packageName": "landscape", "collectionURL": "https://launchpad.net/landscape/"}], "datePublic": "2021-08-11T00:00:00.000Z", "references": [{"url": "https://bugs.launchpad.net/landscape/+bug/1929037", "tags": ["issue-tracking"]}], "descriptions": [{"lang": "en", "value": "Landscape's server-status page exposed sensitive system information. This data leak included GET requests which contain information to attack and leak further information from the Landscape API."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-497", "description": "CWE-497"}]}], "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2023-06-06T15:07:42.162Z"}}}, "cveMetadata": {"cveId": "CVE-2023-32550", "state": "PUBLISHED", "dateUpdated": "2025-01-07T18:01:11.352Z", "dateReserved": "2023-05-09T17:35:10.663Z", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "datePublished": "2023-06-06T15:07:42.162Z", "assignerShortName": "canonical"}, "dataVersion": "5.1"}