Authentication Bypass Affecting homeassistant package, versions [,2023.3.0)
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
7.34% (95th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-HOMEASSISTANT-5406380
- published 3 Apr 2023
- disclosed 3 Apr 2023
- credit Joseph Surin from elttam.
Introduced: 3 Apr 2023
CVE-2023-27482 Open this link in a new tabHow to fix?
Upgrade homeassistant to version 2023.3.0 or higher.
Overview
Affected versions of this package are vulnerable to Authentication Bypass which allows accessing the Supervisor API through Home Assistant has been discovered. This impacts all Home Assistant installation types that use the Supervisor 2023.01.1 or older.
Note: Installation types, like Home Assistant Container (for example Docker), or Home Assistant Core manually in a Python environment are not affected by this vulnerability.
References
CVSS Scores
version 3.1