CVE-2023-30797 HIGH

CVE-2023-30797: Insecure Random Generation in Netflix Lemur

Vendor Netflix
Product Lemur
Weakness CWE-330 · Insufficient randomness
Published April 19, 2023
Last update November 21, 2025
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Netflix Lemur before version 1.3.2 used insufficiently random values when generating default credentials. The insufficiently random values may allow an attacker to guess the credentials and gain access to resources managed by Lemur.

Key dates

02Disclosure timeline

April 19, 2023 CVE published
November 21, 2025 Record updated