PT-2023-20792 · Unknown · Uptime Kuma

Siimots · Published 2023-04-04 · Updated 2023-04-11 · CVE-2023-26777

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Uptime Kuma versions 1.19.6 and before

Description A Cross Site Scripting issue allows a remote attacker to execute arbitrary commands via the description, title, footer, and incident creation parameter of the "status page.js" endpoint.

Recommendations For Uptime Kuma versions 1.19.6 and before, consider disabling the description, title, footer, and incident creation parameters in the status page.js endpoint as a temporary workaround until a patch is available. Restrict access to the status page.js endpoint to minimize the risk of exploitation. Avoid using the parameters related to description, title, footer, and incident creation in the affected endpoint until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-26777

Affected Products

Uptime Kuma

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-26777 · Security Note
• https://osv.dev/vulnerability/CVE-2023-26777 · Vendor Advisory
• https://github.com/louislam/uptime-kuma/issues/2186 · Note
• https://t.me/cvenotify/47916 · Telegram Post
• http://packetstormsecurity.com/files/171699/Uptime-Kuma-1.19.6-Cross-Site-Scripting.html · Note