CVE-2023-49276

Uptime Kuma is an open source self-hosted monitoring tool. In affected versions the Google Analytics element in vulnerable to Attribute Injection leading to Cross-Site-Scripting (XSS). Since the custom status interface can set an independent Google Analytics ID and the template has not been sanitized, there is an attribute injection vulnerability here, which can lead to XSS attacks. This vulnerability has been addressed in commit `f28dccf4e` which is included in release version 1.23.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/louislam/uptime-kuma/commit/f28dccf4e11f041564293e4f407e69ab9ee2277f	Patch
https://github.com/louislam/uptime-kuma/security/advisories/GHSA-v4v2-8h88-65qj	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:uptime.kuma:uptime_kuma:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2023-12-01 22:15

Updated : 2023-12-06 20:29

NVD link : CVE-2023-49276

Mitre link : CVE-2023-49276

CVE.ORG link : CVE-2023-49276

JSON object : View

Products Affected

uptime.kuma

uptime_kuma

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2023-49276", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 4.2, "exploitabilityScore": 2.1}]}, "published": "2023-12-01T22:15:10.563", "references": [{"url": "https://github.com/louislam/uptime-kuma/commit/f28dccf4e11f041564293e4f407e69ab9ee2277f", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/louislam/uptime-kuma/security/advisories/GHSA-v4v2-8h88-65qj", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Uptime Kuma is an open source self-hosted monitoring tool. In affected versions the Google Analytics element in vulnerable to Attribute Injection leading to Cross-Site-Scripting (XSS). Since the custom status interface can set an independent Google Analytics ID and the template has not been sanitized, there is an attribute injection vulnerability here, which can lead to XSS attacks. This vulnerability has been addressed in commit `f28dccf4e` which is included in release version 1.23.7. Users are advised to upgrade. There are no known workarounds for this vulnerability."}, {"lang": "es", "value": "Uptime Kuma es una herramienta de monitoreo autohospedada de c\u00f3digo abierto. En las versiones afectadas, el elemento Google Analytics es vulnerable a la inyecci\u00f3n de atributos que conduce a Cross-Site-Scripting (XSS). Dado que la interfaz de estado personalizada puede establecer un ID de Google Analytics independiente y la plantilla no ha sido sanitizada, aqu\u00ed existe una vulnerabilidad de inyecci\u00f3n de atributos, que puede provocar ataques XSS. Esta vulnerabilidad se ha solucionado en el commit `f28dccf4e` que se incluye en la versi\u00f3n 1.23.7. Se recomienda a los usuarios que actualicen. No se conocen workarounds para esta vulnerabilidad."}], "lastModified": "2023-12-06T20:29:13.000", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:uptime.kuma:uptime_kuma:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "738D525E-0E73-4F2D-BFE6-47646D61CD65", "versionEndExcluding": "1.23.7", "versionStartIncluding": "1.20.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}