Vulnerability Intelligence Report
CVE-2019-12105
In Supervisor through 4.0.2, an unauthenticated user can read log files or restart a service. Note: The maintainer responded that the affected component, inet_http_server, is not enabled by default but if the user enables it and does not set a password, Supervisor logs a warning message. The maintainer indicated the ability to run an open server will not be removed but an additional warning was added to the documentation
No Active Exploit Signals
CVSS Base Score
8.2
HIGH
EPSS Probability:2.28%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| supervisord | supervisor | all |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
2.283%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | MITRE Corporation · N/A · USA |
| Reserved | 2019-05-15T00:00:00 |
| Published | 2019-09-10T16:18:27 |
| Last Updated | 2024-08-04T23:10:30 |
Community Chatter & Buzz