Landscape's Apache server-status is accessible by default
Priority MEDIUM 46CWE-497Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-497.
Summary
Landscape's server-status page exposed sensitive system information. This data leak included GET requests which contain information to attack and leak further information from the Landscape API.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00449 39th percentileScored 2026-11-07
Fix Fixed Landscape (Canonical Ltd.): 19.10.05
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA Landscape (Canonical Ltd.) Fixed in 19.10.05
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Canonical Landscape 19.10.05
3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2023-15831 Landscape insecure token generationPriority LOW 34
- TI-2023-15833 Landscape Open RedirectPriority LOW 27
Timeline
- 2026-10-02 Threatist record created from CVE-2023-32550
- 2026-10-03 Alias added: GHSA-qx9h-hx3f-jr6w
References
More Canonical Landscape vulnerabilities
- TI-2023-15831 Landscape insecure token generation CVSS 3.1HIGH 7.5
- TI-2023-15833 Landscape Open Redirect CVSS 3.1MEDIUM 6.1
Sources
- CVE-2023-32550 · CVE Program
- CVE-2023-32550 · NVD
- FIRST EPSS
- GHSA-qx9h-hx3f-jr6w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences