Uptime Kuma vulnerable to authenticated remote code execution via malicious plugin installation

Summary Installation of a maliciously crafted plugin allows for remote code execution by an authenticated attacker. Details Uptime Kuma allows authenticated users to install plugins from an official list of plugins. This feature is currently disabled in the web interface, but the corresponding AP...

Uptime Kuma's authenticated path traversal via plugin repository name may lead to unavailability or data loss

Summary A path traversal vulnerability via the plugin repository name allows an authenticated attacker to delete files on the server leading to unavailability and potentially data loss. Details Uptime Kuma allows authenticated users to install plugins from an official list of plugins. This featur...

GHSA-VR8X-74PM-6VJ7 Uptime Kuma's authenticated path traversal via plugin repository name may lead to unavailability or data loss

Summary A path traversal vulnerability via the plugin repository name allows an authenticated attacker to delete files on the server leading to unavailability and potentially data loss. Details Uptime Kuma allows authenticated users to install plugins from an official list of plugins. This featur...

GHSA-23Q2-5GF8-GJPP Enabling Authentication does not close all logged in socket connections immediately

Summary This is basically GHSA-88j4-pcx8-q4q but instead of changing passwords, when enabling authentication. PoC - Open Uptime Kuma with authentication disabled - Enable authentication using another window - Access the platform using the previously logged-in window - Note that access read-write...

Enabling Authentication does not close all logged in socket connections immediately

Summary This is basically GHSA-88j4-pcx8-q4q but instead of changing passwords, when enabling authentication. PoC - Open Uptime Kuma with authentication disabled - Enable authentication using another window - Access the platform using the previously logged-in window - Note that access read-write...

Session Fixation

uptime-kuma is vulnerable to Session Fixation. The vulnerability exists when a user changes their login password but a previously logged-in user retains access without being logged out. This behavior persists consistently, even after system restarts or browser restarts. This vulnerability allows...

Password Change Vulnerability

Overview: A moderate security vulnerability has been identified in Uptime Kuma platform that poses a significant threat to the confidentiality and integrity of user accounts. When a user changes their login password in Uptime Kuma, a previously logged-in user retains access without being logged...

GHSA-88J4-PCX8-Q4Q3 Password Change Vulnerability

Overview: A moderate security vulnerability has been identified in Uptime Kuma platform that poses a significant threat to the confidentiality and integrity of user accounts. When a user changes their login password in Uptime Kuma, a previously logged-in user retains access without being logged...

CVE-2023-49805

Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, the application uses WebSocket with Socket.io, but it does not verify that the source of communication is valid. This allows third-party website to access the application on behalf of their client. When connecting...

CVE-2023-49804

Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, when a user changes their login password in Uptime Kuma, a previously logged-in user retains access without being logged out. This behavior persists consistently, even after system restarts or browser restarts. Th...

Cross site request forgery (csrf)

Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, the application uses WebSocket with Socket.io, but it does not verify that the source of communication is valid. This allows third-party website to access the application on behalf of their client. When connecting...

Input validation

Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, when a user changes their login password in Uptime Kuma, a previously logged-in user retains access without being logged out. This behavior persists consistently, even after system restarts or browser restarts. Th...

CVE-2023-49805

Uptime Kuma prior to version 1.23.9 is vulnerable to missing origin validation in Socket.IO WebSocket connections. The server does not verify the Origin header, allowing cross-origin access from third-party sites and potential exposure of sensitive data in protected endpoints, even without user i...

CVE-2023-49805 Uptime Kuma Missing Origin Validation in WebSockets

Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, the application uses WebSocket with Socket.io, but it does not verify that the source of communication is valid. This allows third-party website to access the application on behalf of their client. When connecting...

CVE-2023-49805 Uptime Kuma Missing Origin Validation in WebSockets

Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, the application uses WebSocket with Socket.io, but it does not verify that the source of communication is valid. This allows third-party website to access the application on behalf of their client. When connecting...

CVE-2023-49804

Summary: CVE-2023-49804 affects Uptime Kuma and precedes version 1.23.9. When a user changes their login password, a previously logged-in user remains authenticated and can access the platform, an issue that persists across system/browser restarts. This vulnerability can expose sensitive data due...

CVE-2023-49804 Uptime Kuma Password Change Vulnerability

Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, when a user changes their login password in Uptime Kuma, a previously logged-in user retains access without being logged out. This behavior persists consistently, even after system restarts or browser restarts. Th...

CVE-2023-49804 Uptime Kuma Password Change Vulnerability

Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, when a user changes their login password in Uptime Kuma, a previously logged-in user retains access without being logged out. This behavior persists consistently, even after system restarts or browser restarts. Th...

CVE-2023-49804 Uptime Kuma Password Change Vulnerability

Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, when a user changes their login password in Uptime Kuma, a previously logged-in user retains access without being logged out. This behavior persists consistently, even after system restarts or browser restarts. Th...

PT-2023-31363 · Unknown · Uptime Kuma

Name of the Vulnerable Software and Affected Versions: Uptime Kuma versions prior to 1.23.9 Description: Uptime Kuma is a self-hosted monitoring tool that uses WebSocket with Socket.io. Prior to version 1.23.9, the application does not verify the source of communication, allowing third-party...