{"id":"CVE-2023-44400","published":"2023-10-09T15:15:07Z","modified":"2024-09-18T20:18:45Z","title":"Uptime Kuma has Persistentent User Sessions","vendor":"louislam","product":"uptime-kuma","tier":"tail","description":{"text":"Uptime Kuma is a self-hosted monitoring tool. Prior to version 1.23.3, attackers with access to a user's device can gain persistent account access. This is caused by missing verification of Session Tokens after password changes and/or elapsed inactivity periods. Version 1.23.3 has a patch for the issue.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.7,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00282,"percentile":0.20757,"provenance":"source"},"cwes":[{"id":"CWE-384","name":"Session Fixation"}],"references":[{"url":"https://github.com/louislam/uptime-kuma/security/advisories/GHSA-g9v2-wqcj-j99g","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/louislam/uptime-kuma/issues/3481","tags":["x_refsource_MISC"]},{"url":"https://github.com/louislam/uptime-kuma/commit/88afab6571ef7d4d41bb395cdb6ecd3968835a4a","tags":["x_refsource_MISC"]}],"priority":{"score":8.8,"factors":[{"name":"EPSS percentile","points":4.15},{"name":"CVSS severity","points":4.69}]},"vendorSlug":"louislam","affectedVersions":[{"vendor":"louislam","product":"uptime-kuma","versions":["< 1.23.3"]}],"affected":[{"ecosystem":"npm","package":"uptime-kuma","vulnerableRanges":["<1.23.3"],"patched":["1.23.3"],"from":["GHSA-g9v2-wqcj-j99g"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-2738","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-louislam-uptime-kuma-cve-2023-36821","children":[{"from":"CVE-2023-44400","to":"CVE-2023-49804","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-g9v2-wqcj-j99g","via":"related"},{"kind":"osv-related","provenance":"source","id":"GHSA-88j4-pcx8-q4q3","via":"reference","url":"https://github.com/louislam/uptime-kuma/security/advisories/GHSA-g9v2-wqcj-j99g"},{"kind":"same-code","provenance":"machine","files":["server/server.js","server/util-server.js"],"commits":["https://github.com/louislam/uptime-kuma/commit/88afab6571ef7d4d41bb395cdb6ecd3968835a4a","https://github.com/louislam/uptime-kuma/commit/482049c72b3a650c7bc5c26c2f4d57a21c0e0aa0"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2023-36821","published":"2023-07-05","fixed":"1.22.1","kev":false,"link":{"from":"CVE-2023-36821","to":"CVE-2023-44400","relation":"successor","confidence":"high","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:uptime-kuma","fromFixed":"1.22.1","toFixed":"1.23.3","daysApart":96},{"kind":"same-code","provenance":"machine","files":["server/server.js"],"commits":["https://github.com/louislam/uptime-kuma/commit/a0736e04b2838aae198c2110db244eab6f87757b","https://github.com/louislam/uptime-kuma/commit/88afab6571ef7d4d41bb395cdb6ecd3968835a4a"],"basis":"shared file"}]}},{"cve":"CVE-2023-36822","published":"2023-07-05","fixed":"1.22.1","kev":false},{"cve":"CVE-2023-44400","published":"2023-10-09","fixed":"1.23.3","kev":false},{"cve":"CVE-2023-49276","published":"2023-12-01","fixed":"1.23.7","kev":false,"link":{"from":"CVE-2023-44400","to":"CVE-2023-49276","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:uptime-kuma","fromFixed":"1.23.3","toFixed":"1.23.7","daysApart":53}]}},{"cve":"CVE-2023-49804","published":"2023-12-11","fixed":"1.23.9","kev":false},{"cve":"CVE-2024-56331","published":"2024-12-20","fixed":"2.0.0-beta.1","kev":false}],"package":"npm:uptime-kuma"}}