Session Fixation Affecting uptime-kuma package, versions >=0.0.0
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.04% (6th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-UPTIMEKUMA-6117630
- published 12 Dec 2023
- disclosed 12 Dec 2023
- credit manoonabbasi
Introduced: 12 Dec 2023
CVE-2023-49804 Open this link in a new tabHow to fix?
A fix was pushed into the master branch but not yet published.
Overview
uptime-kuma is a
Affected versions of this package are vulnerable to Session Fixation due to improper session management after a password change. An attacker can maintain access to an account without needing to re-authenticate by using an existing session that should have been invalidated.
Notes:
- This is only exploitable if the attacker has access to an active session before the password change.
- Sessions are only deleted on the client side after a user loggs out, meaning a local attacker could reuse said token with deep system access over the browser
References
CVSS Scores
version 3.1