CVE-2019-13033: Infoleak
In CISOfy Lynis 2.x through 2.7.5, the license key can be obtained by looking at the process list when a data upload is being performed. This license can be used to upload data to a central Lynis server. Although no data can be extracted by knowing the license key, it may be possible to upload the data of additional scans.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-13033?
CVE-2019-13033 is considered a low severity vulnerability as it primarily exposes the license key without allowing data extraction.
How does CVE-2019-13033 affect CISOfy Lynis?
CVE-2019-13033 allows an attacker to obtain the license key from the process list during a data upload, potentially enabling unauthorized data uploads.
How do I fix CVE-2019-13033?
To mitigate CVE-2019-13033, ensure you upgrade to Lynis version 2.8.0 or later where the vulnerability has been addressed.
Which versions of Lynis are affected by CVE-2019-13033?
CVE-2019-13033 affects Lynis versions 2.0.0 through 2.7.5.
Can data be extracted through CVE-2019-13033?
No, CVE-2019-13033 does not allow data extraction, but it does expose the license key which can be misused for unauthorized uploads.