PT-2023-20792 · Unknown · Uptime Kuma

Siimots · Publicado 2023-04-04 · Atualizado 2023-04-11 · CVE-2023-26777

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Uptime Kuma versions 1.19.6 and before

Description A Cross Site Scripting issue allows a remote attacker to execute arbitrary commands via the description, title, footer, and incident creation parameter of the "status page.js" endpoint.

Recommendations For Uptime Kuma versions 1.19.6 and before, consider disabling the description, title, footer, and incident creation parameters in the status page.js endpoint as a temporary workaround until a patch is available. Restrict access to the status page.js endpoint to minimize the risk of exploitation. Avoid using the parameters related to description, title, footer, and incident creation in the affected endpoint until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-26777

Produtos afetados

Uptime Kuma

Referências · 5

• https://github.com/louislam/uptime-kuma/issues/2186 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-26777 · Nota de Segurança
• https://t.me/cvenotify/47916 · Publicação no Telegram
• http://packetstormsecurity.com/files/171699/Uptime-Kuma-1.19.6-Cross-Site-Scripting.html · Nota
• https://osv.dev/vulnerability/CVE-2023-26777 · Aviso do Fabricante