CVE-2019-13033
In CISOfy Lynis 2.x through 2.7.5, the license key can be obtained by looking at the process list...
In CISOfy Lynis 2.x through 2.7.5, the license key can be obtained by looking at the process list when a data upload is being performed. This license can be used to upload data to a central Lynis server. Although no data can be extracted by knowing the license key, it may be possible to upload the data of additional scans.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
In CISOfy Lynis 2.x through 2.7.5, the license key can be obtained by looking at the process list when a data upload is being performed. This license can be used to upload data to a central Lynis server. Although no data can be extracted by knowing the license key, it may be possible to upload the data of additional scans.
- Record
CVE-2019-13033- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
In CISOfy Lynis 2.x through 2.7.5, the license key can be obtained by looking at the process list when a data upload is being performed. This license can be used to upload data to a central Lynis server. Although no data can be extracted by knowing the license key, it may be possible to upload the data of additional scans.
- Record
CVE-2019-13033- Updated
- 2026-11-02
EUVDEUVD-2019-4601 No score
In CISOfy Lynis 2.x through 2.7.5, the license key can be obtained by looking at the process list when a data upload is being performed. This license can be used to upload data to a central Lynis server. Although no data can be extracted by knowing the license key, it may be possible to upload the data of additional scans.
- Record
EUVD-2019-4601- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vxcg-qj63-4mp6
In CISOfy Lynis 2.x through 2.7.5, the license key can be obtained by looking at the process list...
In CISOfy Lynis 2.x through 2.7.5, the license key can be obtained by looking at the process list when a data upload is being performed. This license can be used to upload data to a central Lynis server. Although no data can be extracted by knowing the license key, it may be possible to upload the data of additional scans.
- Record
GHSA-vxcg-qj63-4mp6- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
In CISOfy Lynis 2.x through 2.7.5, the license key can be obtained by looking at the process list when a data upload is being performed. This license can be used to upload data to a central Lynis server. Although no data can be extracted by knowing the license key, it may be possible to upload the data of additional scans.
- Record
CVE-2019-13033- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-13033
In CISOfy Lynis 2.x through 2.7.5, the license key can be obtained by looking at the process list when a data upload is being performed. This license can be used to upload data to a central Lynis server. Although no data can be extracted by knowing the license key, it may be possible to upload the data of additional scans.
- Record
DEBIAN-CVE-2019-13033- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-13033
In CISOfy Lynis 2.x through 2.7.5, the license key can be obtained by looking at the process list when a data upload is being performed. This license can be used to upload data to a central Lynis server. Although no data can be extracted by knowing the license key, it may be possible to upload the data of additional scans.
- Record
UBUNTU-CVE-2019-13033- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11032-1 No score
lynis-3.0.5-3.2 on GA media
These are all security issues fixed in the lynis-3.0.5-3.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11032-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
lynisDebian:12 |
before 3.0.0-1 | 3.0.0-1 |
lynisDebian:13 |
before 3.0.0-1 | 3.0.0-1 |
lynisDebian:14 |
before 3.0.0-1 | 3.0.0-1 |
lynisDebian:8 |
before 1.6.3-1+deb8u1, plus listed versions 1.6.3-1 |
1.6.3-1+deb8u1 |
lynisUbuntu:16.04:LTS |
All versions, plus listed versions 2.1.1-1 |
None known |
lynisUbuntu:18.04:LTS |
All versions, plus listed versions 2.5.0-12.6.0-12.6.2-1 |
None known |
lynisUbuntu:20.04:LTS |
All versions, plus listed versions 2.6.2-1 |
None known |
lynisopenSUSE:Tumbleweed From an advisory covering 3 CVEs |
before 3.0.5-3.2 | 3.0.5-3.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-13033 is a low vulnerability (CVSS 3.3) in Cisofy Lynis, published June 18, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 30th percentile. Fixed in lynis 3.0.0-1.
References
cisofy.com/security/cve/cve-2019-13033
lists.debian.org/debian-lts-announce/2020/06/msg00024.html
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDCHEKNR3HPJRNHE5PYKFH5GNBADTPA7
nvd.nist.gov/vuln/detail/CVE-2019-13033
Show 9 moreShow less
github.com/advisories/GHSA-vxcg-qj63-4mp6
security-tracker.debian.org/tracker/CVE-2019-13033
ubuntu.com/security/CVE-2019-13033
cve.org/CVERecord?id=CVE-2019-13033
suse.com/security/cve/CVE-2017-8108