CVE-2023-44400

Uptime Kuma has Persistentent User Sessions

State: Published
Severity: 6.7 Medium
Published: Oct 9, 2023
Updated: Sep 18, 2024
Reserved: Sep 28, 2023

Description

Uptime Kuma is a self-hosted monitoring tool. Prior to version 1.23.3, attackers with access to a user's device can gain persistent account access. This is caused by missing verification of Session Tokens after password changes and/or elapsed inactivity periods. Version 1.23.3 has a patch for the issue.

Scores

CVSS	Score	Vector	Source
3.1	6.7 Medium	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	GitHub_M

Weaknesses

CWE-384 Session Fixation

Affected Products

Product	Versions
uptime-kumalouislam	< 1.23.3Affected

References

https://github.com/louislam/uptime-kuma/security/advisories/GHSA-g9v2-wqcj-j99g
https://github.com/louislam/uptime-kuma/issues/3481
https://github.com/louislam/uptime-kuma/commit/88afab6571ef7d4d41bb395cdb6ecd3968835a4a

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.