Session Fixation

2023-12-1206:03:15

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

session fixation

vulnerability

uptime-kuma

unauthorized access

user accounts

sensitive information

cve-2023-44400

security

system restarts

browser restarts

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

Low

EPSS

Percentile

5.1%

JSON

uptime-kuma is vulnerable to Session Fixation. The vulnerability exists when a user changes their login password but a previously logged-in user retains access without being logged out. This behavior persists consistently, even after system restarts or browser restarts. This vulnerability allows unauthorized access to user accounts, compromising the security of sensitive information. The same vulnerability was partially fixed in CVE-2023-44400, but logging existing users out of their accounts was forgotten.