CVE-2023-30797

7.5 HIGH

Published: April 19, 2023 Modified: November 21, 2025

Description

Netflix Lemur before version 1.3.2 used insufficiently random values when generating default credentials. The insufficiently random values may allow an attacker to guess the credentials and gain access to resources managed by Lemur.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

CVSS v3.x Details

0.0 Low Medium High Critical 10.0

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory

https://github.com/Netflix/lemur/commit/666d853212174ee7f4e6f8b3b4b389ede1872238

Source: disclosure@vulncheck.com

Patch

https://github.com/Netflix/lemur/security/advisories/GHSA-5fqv-mpj8-h7gm

Source: disclosure@vulncheck.com

Vendor Advisory

https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2023-001.md

Source: disclosure@vulncheck.com

Vendor Advisory

https://vulncheck.com/advisories/netflix-lemur-weak-rng

Source: disclosure@vulncheck.com

Third Party Advisory

https://github.com/Netflix/lemur/commit/666d853212174ee7f4e6f8b3b4b389ede1872238

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://github.com/Netflix/lemur/security/advisories/GHSA-5fqv-mpj8-h7gm

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2023-001.md

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://vulncheck.com/advisories/netflix-lemur-weak-rng

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

8 reference(s) from NVD

Quick Stats

CVSS v3 Score

7.5 / 10.0

EPSS (Exploit Probability)

0.2%

41th percentile

Exploitation Status

Not in CISA KEV

Weaknesses (CWE)

CWE-330 CWE-330 CWE-330

Affected Vendors

netflix

Related CVEs