CVE-2023-50715
CVSS 3.1 Score 4.3 of 10 (medium)
Details
Summary
CVE-2023-50715 is a vulnerability in Home Assistant, an open-source home automation software. The issue exists in versions prior to 2023.12.3 and allows the login page to disclose all active user accounts to unauthenticated browsing requests originating on the Local Area Network (LAN). This disclosure occurs regardless of whether the accounts have logged in or not, and it affects multiple products within the Home Assistant ecosystem. The vulnerability has a base severity rating of MEDIUM and a base score of 4.3 according to NIST's National Vulnerability Database (NVD). It does not require any privileges or user interaction for exploitation and can be exploited from an adjacent network. The impact is considered low in terms of confidentiality but poses a potential danger to organizations as it exposes sensitive user account information. The recommended remediation is to update Home Assistant to version 2023.12.3 or later, which contains a patch for this vulnerability.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions