CVE-2023-44400: Session Fixation

October 9, 2023 (updated October 13, 2023)

Uptime Kuma is a self-hosted monitoring tool. Prior to version 1.23.3, attackers with access to a user’s device can gain persistent account access. This is caused by missing verification of Session Tokens after password changes and/or elapsed inactivity periods. Version 1.23.3 has a patch for the issue.

References

github.com/advisories/GHSA-g9v2-wqcj-j99g
github.com/louislam/uptime-kuma/commit/88afab6571ef7d4d41bb395cdb6ecd3968835a4a
github.com/louislam/uptime-kuma/issues/3481
github.com/louislam/uptime-kuma/security/advisories/GHSA-g9v2-wqcj-j99g
nvd.nist.gov/vuln/detail/CVE-2023-44400

Code Behaviors & Features

Detect and mitigate CVE-2023-44400 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →