PT-2023-22986 · Netflix · Netflix Lemur
CVE-2023-30797
·
Publicado
2023-03-01
·
Atualizado
2025-11-21
CVSS v4.0
8.7
Alta
| Vetor | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Netflix Lemur versions prior to 1.3.2
Description
The issue is related to Netflix Lemur using insufficiently random values when generating default credentials. This may allow an attacker to guess the credentials and gain access to resources managed by Lemur. The potentially affected generated items include configuration secrets such as
SECRET KEY, LEMUR TOKEN SECRET, LEMUR ENCRYPTION KEYS, OAUTH STATE TOKEN SECRET, and others. If a deployment of Lemur is using config secrets generated by Lemur's example config, it is recommended to rotate those config secrets.Recommendations
For versions prior to 1.3.2, update to version 1.3.2 or later to resolve the issue. As a temporary workaround, consider rotating the config secrets that were generated using insecure randomness. For user passwords, one option for rotation would be to directly modify the value in the database to some other unguessable string.
Exploit
Correção
Use of Insufficiently Random Values
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Netflix Lemur