{"affected":[{"defaultStatus":"unaffected","ecosystem":"pypi","packageName":"lemur","product":"Lemur","source":"CNA: VulnCheck","vendor":"Netflix","versions":[{"lessThan":"1.3.2","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"PyPI","packageName":"lemur","product":"lemur","source":"OSV GHSA-5fqv-mpj8-h7gm","vendor":"","versions":[{"status":"affected","version":"0.11.0","versionType":"PyPI"},{"status":"affected","version":"0.2.1","versionType":"PyPI"},{"status":"affected","version":"0.8.0","versionType":"PyPI"},{"status":"affected","version":"0.8.1","versionType":"PyPI"},{"status":"affected","version":"0.9.0","versionType":"PyPI"},{"status":"affected","version":"1.0.0","versionType":"PyPI"},{"status":"affected","version":"1.1.0","versionType":"PyPI"},{"status":"affected","version":"1.2.0","versionType":"PyPI"},{"status":"affected","version":"1.3.1","versionType":"PyPI"},{"events":[{"introduced":"0"},{"fixed":"1.3.2"}],"status":"unknown","version":"0","versionType":"ECOSYSTEM"}]}],"cveId":"CVE-2023-30797","cwes":["CWE-330"],"description":"Netflix Lemur before version 1.3.2 used insufficiently random values when generating default credentials. The insufficiently random values may allow an attacker to guess the credentials and gain access to resources managed by Lemur.","epss":{"date":"2026-11-08","percentile":0.56548,"score":0.00791},"exploits":[],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"CNA: VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},{"score":7.5,"severity":"high","source":"ADP: CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}],"modifiedAt":1794146383453,"publishedAt":1681931412523,"references":[{"source":"CNA: VulnCheck","tags":["vendor-advisory"],"url":"https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2023-001.md"},{"source":"CNA: VulnCheck","tags":["patch"],"url":"https://github.com/Netflix/lemur/commit/666d853212174ee7f4e6f8b3b4b389ede1872238"},{"source":"CNA: VulnCheck","tags":["vendor-advisory"],"url":"https://github.com/Netflix/lemur/security/advisories/GHSA-5fqv-mpj8-h7gm"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://vulncheck.com/advisories/netflix-lemur-weak-rng"},{"source":"ADP: CVE","tags":["vendor-advisory","x_transferred"],"url":"https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2023-001.md"},{"source":"ADP: CVE","tags":["patch","x_transferred"],"url":"https://github.com/Netflix/lemur/commit/666d853212174ee7f4e6f8b3b4b389ede1872238"},{"source":"ADP: CVE","tags":["vendor-advisory","x_transferred"],"url":"https://github.com/Netflix/lemur/security/advisories/GHSA-5fqv-mpj8-h7gm"},{"source":"ADP: CVE","tags":["third-party-advisory","x_transferred"],"url":"https://vulncheck.com/advisories/netflix-lemur-weak-rng"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-5fqv-mpj8-h7gm"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-5fqv-mpj8-h7gm"}],"remediation":[{"kind":"fix","source":"CNA: VulnCheck","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/Netflix/lemur/commit/666d853212174ee7f4e6f8b3b4b389ede1872238"},{"kind":"fix","source":"ADP: CVE","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/Netflix/lemur/commit/666d853212174ee7f4e6f8b3b4b389ede1872238"},{"kind":"fix","source":"OSV GHSA-5fqv-mpj8-h7gm","text":"lemur (PyPI): OSV reports a fixed version 1.3.2. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-5fqv-mpj8-h7gm"}],"revision":"cfff49508badc2e9afb2f9c07101c983db25b0b318fd4ef75fd81cfb4d6f76ef","sources":[{"modifiedAt":1794146383453,"name":"CNA: VulnCheck","retrievedAt":1794146906823,"url":"https://www.cve.org/CVERecord?id=CVE-2023-30797"},{"modifiedAt":1783493585770,"name":"OSV / GitHub Security Advisories","retrievedAt":1794146907518,"url":"https://osv.dev/vulnerability/GHSA-5fqv-mpj8-h7gm"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794150529332,"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-30797"}],"ssvc":{"assessedAt":1738766963482,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Insecure Random Generation in Netflix Lemur","updatedAt":1794150529332}