Information Exposure Affecting homeassistant package, versions [,2023.12.3)
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.09% (39th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-HOMEASSISTANT-6128857
- published 15 Dec 2023
- disclosed 15 Dec 2023
- credit r01k
Introduced: 15 Dec 2023
CVE-2023-50715 Open this link in a new tabHow to fix?
Upgrade homeassistant to version 2023.12.3 or higher.
Overview
Affected versions of this package are vulnerable to Information Exposure due to an issue with the login page, which discloses all active user accounts to any unauthenticated browsing request originating on the Local Area Network. This could potentially allow an unauthorized actor to gain knowledge of all user accounts on the system.
Notes:
This applies to the local subnet where Home Assistant resides and to any private subnet that can reach it.
References
CVSS Scores
version 3.1