CVE-2019-13033: Cisofy Lynis

Low severity, CVSS 3.3. EPSS: 0.4% chance of exploitation in the next 30 days.

In CISOfy Lynis 2.x through 2.7.5, the license key can be obtained by looking at the process list when a data upload is being performed. This license can be used to upload data to a central Lynis server. Although no data can be extracted by knowing the license key, it may be possible to upload the data of additional scans.

Affected products

• Cisofy Lynis: from 2.0.0, up to and including 2.7.5
• Debian Debian Linux: version 8.0 only; version 9.0 only
• Fedoraproject Fedora: version 30 only; version 31 only

Published 2020-06-18. Last modified 2026-06-17.