cve/2023/CVE-2023-27591.md

### [CVE-2023-27591](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27591)
![](https://img.shields.io/static/v1?label=Product&message=v2&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%20%3C%202.0.43%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-1220%3A%20Insufficient%20Granularity%20of%20Access%20Control&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-200%3A%20Exposure%20of%20Sensitive%20Information%20to%20an%20Unauthorized%20Actor&color=brighgreen)

### Description

Miniflux is a feed reader. Prior to version 2.0.43, an unauthenticated user can retrieve Prometheus metrics from a publicly reachable Miniflux instance where the `METRICS_COLLECTOR` configuration option is enabled and `METRICS_ALLOWED_NETWORKS` is set to `127.0.0.1/8` (the default). A patch is available in Miniflux 2.0.43. As a workaround, set `METRICS_COLLECTOR` to `false` (default) or run Miniflux behind a trusted reverse-proxy.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/40826d/advisories
- https://github.com/ARPSyndicate/cvemon