CVE-2021-3325: 
Linux Fedora vulnerability analysis and mitigation

CVE-2021-3325 affects Monitorix version 3.13.0, discovered and disclosed on January 27, 2021. The vulnerability exists in the default installation of Monitorix 3.13.0, specifically affecting its built-in HTTP server's authentication mechanism (Monitorix News, NVD).

The vulnerability allows remote attackers to bypass Basic Authentication in a default installation when the 'hosts_deny' option is not defined. This security issue occurred because a new access-control feature was introduced without considering that existing installations became unsafe upon updating to version 3.13.0, unless the new feature was immediately configured. The vulnerability has been assigned a CVSS v3.1 base score of 9.8 CRITICAL (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) (NVD).

The vulnerability allows unauthorized remote attackers to bypass authentication controls and gain access to the Monitorix monitoring system. This could potentially expose sensitive system monitoring data and configurations to unauthorized users (NVD).

The vulnerability is easily exploitable as it requires no special conditions or user interaction. It can be exploited remotely by accessing the Monitorix web interface in installations where the 'hosts_deny' option is not configured, which is the default setting (Monitorix Commit).

The vulnerability was fixed in Monitorix version 3.13.1. The fix includes updating the main configuration file to add 'hosts_deny = all' by default inside the auth subsection. All users of version 3.13.0 are strongly advised to upgrade to version 3.13.1. The fix was implemented by modifying the HTTP server's authentication behavior to force Basic Authentication for any host when the hosts_deny option is not defined (Fedora Update).