Vulnerabilities

TI-2023-18616 CVE-2023-36822 · GHSA-vr8x-74pm-6vj7

Uptime Kuma authenticated path traversal via plugin repository name may lead to unavailability or data loss

HIGH 68

Uptime Kuma, a self-hosted monitoring tool, has a path traversal vulnerability in versions prior to 1.22.1.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.01213 Published 2023-07-05 Fixed in 1.22.1 CWE-22

TI-2023-18615 CVE-2023-36821 · GHSA-7grx-f945-mj96

Uptime Kuma vulnerable to authenticated remote code execution via malicious plugin installation

HIGH 73

Uptime Kuma, a self-hosted monitoring tool, allows an authenticated attacker to install a maliciously crafted plugin in versions prior to 1.22.1, which may lead to remote code execution.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02017 Published 2023-07-05 Fixed in 1.22.1 CWE-20

TI-2023-11081 CVE-2023-25811

Persistent Cross site scripting (XSS) in Uptime Kuma

MEDIUM 61

Uptime Kuma is a self-hosted monitoring tool.

CVSS 3.1MEDIUM 6.3 Network Low privileges User interaction EPSS 0.00474 Published 2023-02-21 Fixed in 1.20.0 CWE-79

TI-2023-11080 CVE-2023-25810

Persistent Cross site scripting (XSS) through description in status page in Uptime Kuma

LOW 28