CVE-2023-44400

HIGH EPSS 18.3%
Published Oct 9, 20232y ago · Modified Jun 17, 20262w ago
7.8 CVSS 3.1
High
Find Similar
Published Oct 9, 2023 2y ago
Last Modified Jun 17, 2026 2w ago

Description

Uptime Kuma is a self-hosted monitoring tool. Prior to version 1.23.3, attackers with access to a user's device can gain persistent account access. This is caused by missing verification of Session Tokens after password changes and/or elapsed inactivity periods. Version 1.23.3 has a patch for the issue.

CVSS Details

Base Score
7.8
Exploitability
1.8
Impact
5.9
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
18.3% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-384

Affected Products 1

VendorProductVersionRange
uptime.kumauptime_kuma* <1.23.3

References 3

  • github.com https://github.com/louislam/uptime-kuma/commit/88afab6571ef7d4d41bb395cdb6ecd3968835a4a
    Patch
  • github.com https://github.com/louislam/uptime-kuma/issues/3481
    Issue TrackingMitigation
  • github.com https://github.com/louislam/uptime-kuma/security/advisories/GHSA-g9v2-wqcj-j99g
    ExploitVendor Advisory

Remediation

  • github.com https://github.com/louislam/uptime-kuma/commit/88afab6571ef7d4d41bb395cdb6ecd3968835a4a
    Patch