Enabled default configuration In miniflux.app/v2
Description
Unauthenticated Miniflux user can bypass allowed networks check to obtain Prometheus metrics
Impact
An unauthenticated user can retrieve Prometheus metrics from a publicly reachable Miniflux instance where the METRICS_COLLECTOR configuration option is enabled and METRICS_ALLOWED_NETWORKS is set to 127.0.0.1/8 (the default).
Patches
PR #1745 fixes the problem. Available in Miniflux >= 2.0.43.
Workarounds
Set METRICS_COLLECTOR to false (default) or run Miniflux behind a trusted reverse-proxy.
References
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 go | 2.0.43 | ||
go | - |
Aliases
1. 2. 3. 4. 5.
References
1. 2. 3. 4.