PT-2019-13725 · Sphinx Technologies+1 · Sphinx+1

Published 2019-06-02 · Updated 2022-04-01 · CVE-2019-14511

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Sphinx Technologies Sphinx version 3.1.1

Description The issue is related to the default configuration of Sphinx, which lacks authentication and listens on 0.0.0.0, making it exposed to the internet unless filtered by a firewall or reconfigured to listen to 127.0.0.1 only.

Recommendations For version 3.1.1, reconfigure Sphinx to listen on 127.0.0.1 only or ensure it is filtered by a firewall to minimize exposure. Consider implementing authentication to secure the service.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

CWE-21

Related Identifiers

BDU:2022-00467

CVE-2019-14511

DLA-2882-1

DSA-5036-1

MGASA-2020-0087

OPENSUSE-SU-2022_0046-1

OPENSUSE-SU-2022_0054-1

Affected Products

Sphinx

Suse

References · 30

• 🔥 https://blog.wirhabenstil.de/2019/08/19/sphinxsearch-0-0-0-09306-cve-2019-14511 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2019-14511 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/YSLPW44RWIGHU5AG3P4U2HPSD3UBG4GJ · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-14511 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3FPPNZZMWTZOMFGFETMET6YKIH2DQDKS · Vendor Advisory
• https://advisories.mageia.org/MGASA-2020-0087.html · Security Note
• https://cve.org/CVERecord?id=CVE-2019-14511 · Security Note
• http://sphinxsearch.com/docs/sphinx3.html#getting-started-on-linux-and-macos · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XD25JJJVM7FFXAO2L3ZG2KXQ6UMFBIA4 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YSLPW44RWIGHU5AG3P4U2HPSD3UBG4GJ · Vendor Advisory
• https://debian.org/security/2022/dsa-5036 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-14511 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-14511 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5036-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2882-1 · Vendor Advisory