CVE-2023-30797

HighCVSS 7.5/10Last modified Jul 15, 2026

Description

Netflix Lemur before version 1.3.2 used insufficiently random values when generating default credentials. The insufficiently random values may allow an attacker to guess the credentials and gain access to resources managed by Lemur.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-330

Affected software

Vendor	Product	Versions
Netflix	Lemur	< 1.3.2

References

https://github.com/Netflix/lemur/commit/666d853212174ee7f4e6f8b3b4b389ede1872238Patch
https://github.com/Netflix/lemur/security/advisories/GHSA-5fqv-mpj8-h7gmVendor Advisory
https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2023-001.mdVendor Advisory
https://vulncheck.com/advisories/netflix-lemur-weak-rngThird Party Advisory
https://github.com/Netflix/lemur/commit/666d853212174ee7f4e6f8b3b4b389ede1872238Patch
https://github.com/Netflix/lemur/security/advisories/GHSA-5fqv-mpj8-h7gmVendor Advisory
https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2023-001.mdVendor Advisory
https://vulncheck.com/advisories/netflix-lemur-weak-rngThird Party Advisory

Timeline

Published: Apr 19, 2023
Last modified: Jul 15, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-307987.5There MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to s CVE-2023-307997.2MikroTik RouterOS stable before 6.49.7 and long-term through 6.48.6 are vulnerable to a privilege escalation issue. A remote and authenticat CVE-2023-30806.1The WP Mail Catcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including,CVE-2023-308007.5The web server used by MikroTik RouterOS version 6 is affected by a heap memory corruption issue. A remote and unauthenticated attacker can CVE-2023-308019.8All versions of the qBittorrent client through 4.5.5 use default credentials when the web user interface is enabled. The administrator is no CVE-2023-308025.3The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to a source code disclosure vulnerability. A remote and unauthent CVE-2023-308039.8The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an authentication bypass vulnerability. A remote and unauthent CVE-2023-308046.5The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an authenticated file disclosure vulnerability. A remote and a CVE-2023-308059.8The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an operating system command injection vulnerability. A remote CVE-2023-308069.8The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an operating system command injection vulnerability. A remote CVE-2023-30816.1The WP Mail Logging plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 1 CVE-2023-30826.1The Post SMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 2.5.7 d