Lucene search

GitHub_MCVE-2023-25811

HistoryFeb 21, 2023 - 9:15 p.m.

CVE-2023-25811

2023-02-2121:15:11

CWE-79

GitHub_M

web.nvd.nist.gov

uptime kuma

monitoring tool

self-hosted

cve-2023-25811

persistent xss

upgrade advisory

CVSS3

6.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N

EPSS

0.001

Percentile

25.5%

JSON

Uptime Kuma is a self-hosted monitoring tool. In versions prior to 1.20.0 the Uptime Kuma name parameter allows a persistent XSS attack. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected configurations

Nvd

Vulners

Node

uptime-kuma_projectuptime-kumaRange<1.20.0

VendorProductVersionCPE
uptime-kuma_projectuptime-kuma*cpe:2.3:a:uptime-kuma_project:uptime-kuma:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
uptime-kuma_project	uptime-kuma	*	cpe:2.3:a:uptime-kuma_project:uptime-kuma::::::::

CNA Affected

[
  {
    "vendor": "louislam",
    "product": "uptime-kuma",
    "versions": [
      {
        "version": "< 1.20.0",
        "status": "affected"
      }
    ]
  }
]

References

github.com/louislam/uptime-kuma/security/advisories/GHSA-553g-fcpf-m3wp