Back to Database
Status published
Medium
CVE-2023-44400
Uptime Kuma has Persistentent User Sessions
Vulnerability Description
Uptime Kuma is a self-hosted monitoring tool. Prior to version 1.23.3, attackers with access to a user's device can gain persistent account access. This is caused by missing verification of Session Tokens after password changes and/or elapsed inactivity periods. Version 1.23.3 has a patch for the issue.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-44400
Credits & Attribution
No credits recorded in the NVD database.
References
More from louislam
View All →CVE-2024-56331
Local File Inclusion (LFI) via Improper URL Handling in uptime-kuma's `Real-Browser` monitor
Medium
6.8
CVE-2023-49805
Uptime Kuma Missing Origin Validation in WebSockets
Medium
6
CVE-2023-49804
Uptime Kuma Password Change Vulnerability
Medium
6.7
CVE-2023-49276
Attribute Injection leading to XSS(Cross-Site-Scripting) in uptime-kuma
Medium
6.3
CVE-2023-36822
Uptime Kuma authenticated path traversal via plugin repository name may lead to unavailability or data loss
Medium
6.5
Affected Vendor
louislam
View all reports →Affected Software
uptime-kuma
Vulnerable Versions:
< 1.23.3
Timeline
Official Publish:
October 9th, 2023
Last Modified:
September 18th, 2024
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H