PT-2023-20792 · Unknown · Uptime Kuma

Siimots · CVE-2023-26777 · Published 2023-04-04 · Updated 2023-04-11

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Uptime Kuma versions 1.19.6 and before

Description A Cross Site Scripting issue allows a remote attacker to execute arbitrary commands via the description, title, footer, and incident creation parameter of the "status page.js" endpoint.

Recommendations For Uptime Kuma versions 1.19.6 and before, consider disabling the description, title, footer, and incident creation parameters in the status page.js endpoint as a temporary workaround until a patch is available. Restrict access to the status page.js endpoint to minimize the risk of exploitation. Avoid using the parameters related to description, title, footer, and incident creation in the affected endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-26777

Affected Products

Uptime Kuma

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26777.json · Exploit
• https://osv.dev/vulnerability/CVE-2023-26777 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-26777 · Security Note
• https://github.com/louislam/uptime-kuma/issues/2186 · Note
• https://t.me/cvenotify/47916 · Telegram Post
• http://packetstormsecurity.com/files/171699/Uptime-Kuma-1.19.6-Cross-Site-Scripting.html · Note