CVE-2023-36821

Katalog CVE

CVSS 8.8 · High EPSS 2,0%

Kerentanan Improper Input Validation pada uptime-kuma project uptime-kuma. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Uptime Kuma, a self-hosted monitoring tool, allows an authenticated attacker to install a maliciously crafted plugin in versions prior to 1.22.1, which may lead to remote code execution. Uptime Kuma allows authenticated users to install plugins from an official list of plugins. This feature is currently disabled in the web interface, but the corresponding API endpoints are still available after login. After downloading a plugin, it's installed by calling `npm install` in the installation directory of the plugin. Because the plugin is not validated against the official list of plugins or installed with `npm install --ignore-scripts`, a maliciously crafted plugin taking advantage of npm scripts can gain remote code execution. Version 1.22.1 contains a patch for this issue.

Rincian

Terbit di NVD

5 Juli 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation

EPSS (30 hari)

2,0% peluang dieksploitasi; lebih tinggi dari 80,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/louislam/uptime-kuma/security/advisories/GHSA-7grx-f945-mj96 exploit · advisory vendor
• https://github.com/louislam/uptime-kuma/pull/3346 patch
• https://github.com/louislam/uptime-kuma/blob/8c60e902e1c76ecbbd1b0423b07ce615341cb850/server/plugins-manager.j... product
• https://github.com/louislam/uptime-kuma/releases/tag/1.22.1 release notes