Critical · 9.3 CVE-2023-32550 EUVD-2023-36794GHSA-qx9h-hx3f-jr6w

Landscape's Apache server-status is accessible by default

Published Jun 6, 2023 · Updated Jan 7, 2025 · Assigned by canonical

Description

Landscape's server-status page exposed sensitive system information. This data leak included GET requests which contain information to attack and leak further information from the Landscape API.

Affected products

Vendor	Product	Affected	Fixed
Canonical	Landscape	< 19.10.05	19.10.05

References

https://bugs.launchpad.net/landscape/+bug/1929037 issue-tracking