CVE-2019-14511
Sphinx Technologies Sphinx 3.1.1 by default has no authentication and listens on 0.0.0.0, making...
Sphinx Technologies Sphinx 3.1.1 by default has no authentication and listens on 0.0.0.0, making it exposed to the internet (unless filtered by a firewall or reconfigured to listen to 127.0.0.1 only).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Sphinx Technologies Sphinx 3.1.1 by default has no authentication and listens on 0.0.0.0, making it exposed to the internet (unless filtered by a firewall or reconfigured to listen to 127.0.0.1 only).
- Record
CVE-2019-14511- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-306
- Updated
- 2026-11-02
CVE List No score
Sphinx Technologies Sphinx 3.1.1 by default has no authentication and listens on 0.0.0.0, making it exposed to the internet (unless filtered by a firewall or reconfigured to listen to 127.0.0.1 only).
- Record
CVE-2019-14511- Updated
- 2026-11-02
EUVDEUVD-2019-5686 No score
Sphinx Technologies Sphinx 3.1.1 by default has no authentication and listens on 0.0.0.0, making it exposed to the internet (unless filtered by a firewall or reconfigured to listen to 127.0.0.1 only).
- Record
EUVD-2019-5686- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-w8f6-g5xv-w78j
Sphinx Technologies Sphinx 3.1.1 by default has no authentication and listens on 0.0.0.0, making...
Sphinx Technologies Sphinx 3.1.1 by default has no authentication and listens on 0.0.0.0, making it exposed to the internet (unless filtered by a firewall or reconfigured to listen to 127.0.0.1 only).
- Record
GHSA-w8f6-g5xv-w78j- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-306
- Updated
- 2026-11-02
OSV
Sphinx Technologies Sphinx 3.1.1 by default has no authentication and listens on 0.0.0.0, making it exposed to the internet (unless filtered by a firewall or reconfigured to listen to 127.0.0.1 only).
- Record
CVE-2019-14511- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-14511
Sphinx Technologies Sphinx 3.1.1 by default has no authentication and listens on 0.0.0.0, making it exposed to the internet (unless filtered by a firewall or reconfigured to listen to 127.0.0.1 only).
- Record
DEBIAN-CVE-2019-14511- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-14511
Sphinx Technologies Sphinx 3.1.1 by default has no authentication and listens on 0.0.0.0, making it exposed to the internet (unless filtered by a firewall or reconfigured to listen to 127.0.0.1 only).
- Record
UBUNTU-CVE-2019-14511- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVMGASA-2020-0087 No score
Updated sphinx packages fix security vulnerability
Updated sphinx packages fix security vulnerability:
A vulnerability was found in Sphinx Technologies Sphinx 3.1.1 by default has no authentication and listens on 0.0.0.0, making it exposed to the internet, unless filtered by a firewall or reconfigured to listen to 127.0.0.1 only (CVE-2019-14511).
- Record
MGASA-2020-0087- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
sphinxsearchDebian:12 |
before 2.2.11-4 | 2.2.11-4 |
sphinxsearchDebian:13 |
before 2.2.11-4 | 2.2.11-4 |
sphinxsearchDebian:14 |
before 2.2.11-4 | 2.2.11-4 |
sphinxMageia:7 |
before 2.3.2-0.beta.1.1.mga7 | 2.3.2-0.beta.1.1.mga7 |
sphinxsearchUbuntu:16.04:LTS |
All versions, plus listed versions 2.0.4-1.1ubuntu22.2.9-12.2.9-1build1 |
None known |
sphinxsearchUbuntu:18.04:LTS |
All versions, plus listed versions 2.2.11-2 |
None known |
sphinxsearchUbuntu:20.04:LTS |
All versions, plus listed versions 2.2.11-2build12.2.11-2ubuntu12.2.11-2ubuntu2 |
None known |
sphinxsearchUbuntu:22.04:LTS |
All versions, plus listed versions 2.2.11-2ubuntu22.2.11-8 |
None known |
sphinxsearchUbuntu:24.04:LTS |
All versions, plus listed versions 2.2.11-8build1 |
None known |
sphinxsearchUbuntu:25.10 |
All versions, plus listed versions 2.2.11-8build42.2.11-8build5 |
None known |
sphinxsearchUbuntu:26.10 |
All versions, plus listed versions 2.2.11-8build62.2.11-112.2.11-11ubuntu1 |
None known |
sphinxsearchUbuntu:26.04:LTS |
All versions, plus listed versions 2.2.11-8build52.2.11-8build6 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-14511 is a high vulnerability (CVSS 7.5) in Sphinxsearch Sphinx, published August 22, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.10%, the 81st percentile. Fixed in sphinxsearch 2.2.11-4.
References
sphinxsearch.com/docs/sphinx3.html
blog.wirhabenstil.de/2019/08/19/sphinxsearch-0-0-0-09306-cve-2019-14511
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YSLPW44RWIGHU5AG3P4U2HPSD3UBG4GJ
Show 10 moreShow less
nvd.nist.gov/vuln/detail/CVE-2019-14511
github.com/advisories/GHSA-w8f6-g5xv-w78j
security-tracker.debian.org/tracker/CVE-2019-14511
advisories.mageia.org/MGASA-2020-0087.html
bugs.mageia.org/show_bug.cgi?id=25946
ubuntu.com/security/CVE-2019-14511
cve.org/CVERecord?id=CVE-2019-14511