{"id":"CVE-2019-14511","aliases":["DEBIAN-CVE-2019-14511","EUVD-2019-5686","GHSA-w8f6-g5xv-w78j","MGASA-2020-0087","UBUNTU-CVE-2019-14511"],"status":"published","title":"Sphinx Technologies Sphinx 3.1.1 by default has no authentication and listens on 0.0.0.0, making...","description":"Sphinx Technologies Sphinx 3.1.1 by default has no authentication and listens on 0.0.0.0, making it exposed to the internet (unless filtered by a firewall or reconfigured to listen to 127.0.0.1 only).","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02099,"percentile":0.81831,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-306"],"published":"2019-08-22T12:26:41Z","modified":"2026-10-17T12:55:39Z","fixes":[{"ecosystem":"Debian:12","package":"sphinxsearch","fixed_in":["2.2.11-4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"sphinxsearch","fixed_in":["2.2.11-4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"sphinxsearch","fixed_in":["2.2.11-4"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"sphinx","fixed_in":["2.3.2-0.beta.1.1.mga7"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"sphinxsearch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.11-4"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"sphinxsearch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.11-4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"sphinxsearch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.11-4"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"sphinx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.2-0.beta.1.1.mga7"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"sphinxsearch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.4-1.1ubuntu2","2.2.9-1","2.2.9-1build1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"sphinxsearch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.11-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"sphinxsearch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.11-2build1","2.2.11-2ubuntu1","2.2.11-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"sphinxsearch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.11-2ubuntu2","2.2.11-8"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"sphinxsearch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.11-8build1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"sphinxsearch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.11-8build4","2.2.11-8build5"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"sphinxsearch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.11-8build6","2.2.11-11","2.2.11-11ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"sphinxsearch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.11-8build5","2.2.11-8build6"]}],"products":[{"vendor":"sphinxsearch","product":"sphinx"}],"references":[{"url":"http://sphinxsearch.com/docs/sphinx3.html#getting-started-on-linux-and-macos","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory"]},{"url":"https://sphinxsearch.com/blog/","tags":["x_refsource_MISC","x_transferred","Release Notes","advisory"]},{"url":"https://blog.wirhabenstil.de/2019/08/19/sphinxsearch-0-0-0-09306-cve-2019-14511/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YSLPW44RWIGHU5AG3P4U2HPSD3UBG4GJ/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XD25JJJVM7FFXAO2L3ZG2KXQ6UMFBIA4/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3FPPNZZMWTZOMFGFETMET6YKIH2DQDKS/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-14511"},{"url":"https://blog.wirhabenstil.de/2019/08/19/sphinxsearch-0-0-0-09306-cve-2019-14511"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3FPPNZZMWTZOMFGFETMET6YKIH2DQDKS"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XD25JJJVM7FFXAO2L3ZG2KXQ6UMFBIA4"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YSLPW44RWIGHU5AG3P4U2HPSD3UBG4GJ"},{"url":"https://sphinxsearch.com/blog"},{"url":"https://github.com/advisories/GHSA-w8f6-g5xv-w78j"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-14511","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0087.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25946","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/YSLPW44RWIGHU5AG3P4U2HPSD3UBG4GJ/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-14511","tags":["report"]},{"url":"https://github.com/manticoresoftware/manticoresearch/issues/261","tags":["report"]},{"url":"https://github.com/manticoresoftware/manticoresearch/commit/023c9b2acb24db5e9c6d8052afa68660aeee8d3e","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-14511","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-14511","description":"Sphinx Technologies Sphinx 3.1.1 by default has no authentication and listens on 0.0.0.0, making it exposed to the internet (unless filtered by a firewall or reconfigured to listen to 127.0.0.1 only).","status":"published","published":"2019-08-22T12:26:41Z","modified":"2024-08-05T00:19:41.184Z","updated_at":"2026-11-02T14:20:18.085548Z"}],"euvd":[{"id":"EUVD-2019-5686","description":"Sphinx Technologies Sphinx 3.1.1 by default has no authentication and listens on 0.0.0.0, making it exposed to the internet (unless filtered by a firewall or reconfigured to listen to 127.0.0.1 only).","status":"published","published":"2019-08-22T12:26:41Z","modified":"2024-08-05T00:19:41Z","updated_at":"2026-11-03T02:40:39.076786Z"}],"ghsa":[{"id":"GHSA-w8f6-g5xv-w78j","title":"Sphinx Technologies Sphinx 3.1.1 by default has no authentication and listens on 0.0.0.0, making...","description":"Sphinx Technologies Sphinx 3.1.1 by default has no authentication and listens on 0.0.0.0, making it exposed to the internet (unless filtered by a firewall or reconfigured to listen to 127.0.0.1 only).","status":"published","published":"2022-05-24T16:54:33Z","modified":"2024-04-04T01:46:26Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:56:02.23917Z"}],"nvd":[{"id":"CVE-2019-14511","description":"Sphinx Technologies Sphinx 3.1.1 by default has no authentication and listens on 0.0.0.0, making it exposed to the internet (unless filtered by a firewall or reconfigured to listen to 127.0.0.1 only).","status":"published","published":"2019-08-22T13:15:12.81Z","modified":"2026-06-17T02:18:33.743Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:05:23.725587Z"}],"osv":[{"id":"CVE-2019-14511","description":"Sphinx Technologies Sphinx 3.1.1 by default has no authentication and listens on 0.0.0.0, making it exposed to the internet (unless filtered by a firewall or reconfigured to listen to 127.0.0.1 only).","status":"published","published":"2019-08-22T13:15:12.81Z","modified":"2026-04-16T04:43:44.036144314Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:11.029493Z"},{"id":"DEBIAN-CVE-2019-14511","description":"Sphinx Technologies Sphinx 3.1.1 by default has no authentication and listens on 0.0.0.0, making it exposed to the internet (unless filtered by a firewall or reconfigured to listen to 127.0.0.1 only).","status":"published","published":"2019-08-22T13:15:12.81Z","modified":"2026-09-21T07:01:07.377859865Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:31.467893Z"},{"id":"UBUNTU-CVE-2019-14511","description":"Sphinx Technologies Sphinx 3.1.1 by default has no authentication and listens on 0.0.0.0, making it exposed to the internet (unless filtered by a firewall or reconfigured to listen to 127.0.0.1 only).","status":"published","published":"2019-08-22T13:15:00Z","modified":"2026-10-17T12:55:39.261642314Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:19.6877Z"},{"id":"MGASA-2020-0087","title":"Updated sphinx packages fix security vulnerability","description":"Updated sphinx packages fix security vulnerability:\n\nA vulnerability was found in Sphinx Technologies Sphinx 3.1.1 by default has\nno authentication and listens on 0.0.0.0, making it exposed to the internet,\nunless filtered by a firewall or reconfigured to listen to 127.0.0.1 only\n(CVE-2019-14511).\n","status":"published","published":"2020-02-18T14:05:53Z","modified":"2026-04-16T04:41:23.657206364Z","updated_at":"2026-11-02T15:49:41.151324Z"}]}}