CVE-2023-49276: medium-severity vulnerability in louislam uptime-kuma
Attribute Injection leading to XSS(Cross-Site-Scripting) in uptime-kuma
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.3epss 0.5%
Uptime Kuma is an open source self-hosted monitoring tool. In affected versions the Google Analytics element in vulnerable to Attribute Injection leading to Cross-Site-Scripting (XSS). Since the custom status interface can set an independent Google Analytics ID and the template has not been sanitized, there is an attribute injection vulnerability here, which can lead to XSS attacks. This vulnerability has been addressed in commit `f28dccf4e` which is included in release version 1.23.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N
Affected products
louislam · uptime-kumaRelated CVEs — louislam uptime-kuma
In the same product, most dangerous first.
CVE-2023-36821HIGHUptime Kuma vulnerable to authenticated remote code execution via malicious plugin installationEPSS 2.0%CVE-2024-56331MEDIUMLocal File Inclusion (LFI) via Improper URL Handling in uptime-kuma's `Real-Browser` monitorEPSS 1.8%CVE-2023-36822MEDIUMUptime Kuma authenticated path traversal via plugin repository name may lead to unavailability or data lossEPSS 1.2%CVE-2026-32230MEDIUMUptime Kuma is Missing Authorization Checks on Ping Badge Endpoint, Leaks Ping times of monitors without needing to be on a status pageEPSS 1.0%CVE-2023-25811MEDIUMPersistent Cross site scripting (XSS) in Uptime KumaEPSS 0.5%CVE-2023-25810MEDIUMPersistent Cross site scripting (XSS) through description in status page in Uptime KumaEPSS 0.4%