CyberRota Analysis
AI-GeneratedThe Glances monitoring tool prior to version 4.5.6 is vulnerable due to the as_dict_secure() function, which inadequately checks option names, allowing unauthenticated access to sensitive information, including public usernames and credentials via specific API requests. This could lead to unauthorized access to system configurations and potential exploitation of the monitored systems. Organizations using Glances should prioritize upgrading to version 4.5.6 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, as_dict_secure() in glances/config.py checks only option names and exposes public_username and credentials embedded in public_api values through unauthenticated GET /api/4/config and GET /api/4/config/ip requests. This issue is fixed in 4.5.6.