PT-2023-32999 · Umami · Umami

Published 2023-07-28 · Updated 2023-07-28

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Umami (affected versions not specified)

Description The issue allows anyone with a share link to reset website data. When a user navigates to a /share/ URL, they receive a share token used for authentication, which is later verified by useAuth. This token can be used to call most GET APIs for fetching website stats. However, the POST /reset endpoint is secured using canViewWebsite, which is an incorrect verification for such a destructive action, making it possible to completely reset all website data with only view permissions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

GHSA-8WWW-CFFH-4Q98

Affected Products

Umami

References · 4

• https://osv.dev/vulnerability/GHSA-8www-cffh-4q98 · Vendor Advisory
• https://github.com/umami-software/umami · Note
• https://github.com/umami-software/umami/security/advisories/GHSA-8www-cffh-4q98 · Note
• https://github.com/umami-software/umami/commit/ec48a4e3250e9cefc481b339a90e6ceea6f1ec2b · Note