CVE-2023-49804

HIGH EPSS 17.6%
Published Dec 11, 20232y ago · Modified Jun 17, 20262w ago
7.8 CVSS 3.1
High
Find Similar
Published Dec 11, 2023 2y ago
Last Modified Jun 17, 2026 2w ago

Description

Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, when a user changes their login password in Uptime Kuma, a previously logged-in user retains access without being logged out. This behavior persists consistently, even after system restarts or browser restarts. This vulnerability allows unauthorized access to user accounts, compromising the security of sensitive information. The same vulnerability was partially fixed in CVE-2023-44400, but logging existing users out of their accounts was forgotten. To mitigate the risks associated with this vulnerability, the maintainers made the server emit a `refresh` event (clients handle this by reloading) and then disconnecting all clients except the one initiating the password change. It is recommended to update Uptime Kuma to version 1.23.9.

CVSS Details

Base Score
7.8
Exploitability
1.8
Impact
5.9
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
17.6% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-384

Affected Products 2

VendorProductVersionRange
dockge.kumadockge* <1.3.3
uptime.kumauptime_kuma* <1.23.9

References 3

  • github.com https://github.com/louislam/uptime-kuma/commit/482049c72b3a650c7bc5c26c2f4d57a21c0e0aa0
    Patch
  • github.com https://github.com/louislam/uptime-kuma/security/advisories/GHSA-88j4-pcx8-q4q3
    Vendor Advisory
  • github.com https://github.com/louislam/uptime-kuma/security/advisories/GHSA-g9v2-wqcj-j99g
    Not Applicable

Remediation

  • github.com https://github.com/louislam/uptime-kuma/commit/482049c72b3a650c7bc5c26c2f4d57a21c0e0aa0
    Patch