Vulnerability Description
Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, when a user changes their login password in Uptime Kuma, a previously logged-in user retains access without being logged out. This behavior persists consistently, even after system restarts or browser restarts. This vulnerability allows unauthorized access to user accounts, compromising the security of sensitive information. The same vulnerability was partially fixed in CVE-2023-44400, but logging existing users out of their accounts was forgotten. To mitigate the risks associated with this vulnerability, the maintainers made the server emit a `refresh` event (clients handle this by reloading) and then disconnecting all clients except the one initiating the password change. It is recommended to update Uptime Kuma to version 1.23.9.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Dockge.Kuma | Dockge | < 1.3.3 |
| Uptime.Kuma | Uptime Kuma | < 1.23.9 |
Related Weaknesses (CWE)
References
- https://github.com/louislam/uptime-kuma/commit/482049c72b3a650c7bc5c26c2f4d57a21Patch
- https://github.com/louislam/uptime-kuma/security/advisories/GHSA-88j4-pcx8-q4q3Vendor Advisory
- https://github.com/louislam/uptime-kuma/security/advisories/GHSA-g9v2-wqcj-j99gNot Applicable
- https://github.com/louislam/uptime-kuma/commit/482049c72b3a650c7bc5c26c2f4d57a21Patch
- https://github.com/louislam/uptime-kuma/security/advisories/GHSA-88j4-pcx8-q4q3Vendor Advisory
- https://github.com/louislam/uptime-kuma/security/advisories/GHSA-g9v2-wqcj-j99gNot Applicable
FAQ
What is CVE-2023-49804?
CVE-2023-49804 is a vulnerability with a CVSS score of 6.7 (MEDIUM). Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, when a user changes their login password in Uptime Kuma, a previously logged-in user retains access without being lo...
How severe is CVE-2023-49804?
CVE-2023-49804 has been rated MEDIUM with a CVSS base score of 6.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-49804?
Check the references section above for vendor advisories and patch information. Affected products include: Dockge.Kuma Dockge, Uptime.Kuma Uptime Kuma.