Information Exposure Through Sent Data Affecting homeassistant package, versions [,2023.9.0)
Threat Intelligence
EPSS
0.06% (29th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-HOMEASSISTANT-6037029
- published 27 Oct 2023
- disclosed 26 Oct 2023
- credit Unknown
Introduced: 26 Oct 2023
CVE-2023-41893 Open this link in a new tabHow to fix?
Upgrade homeassistant to version 2023.9.0 or higher.
Overview
Affected versions of this package are vulnerable to Information Exposure Through Sent Data via the redirect_uri and client_id parameters. Consequently, the code parameter utilized to fetch the access_token post-authentication will be sent to the URL specified in the aforementioned parameters.
Note: This is only exploitable if the victim's Home Assistant is exposed to the Internet and the victim authenticates via a link sent by the attacker.
References
CVSS Scores
version 3.1