CVE-2023-44385CWE-352

Client-Side Request Forgery in Home Assistant iOS/macOS native Apps

High · published October 19, 2023

CVSS v3.1
8.6
EPSS
0%
Percentile
22.3
In the wild
Unconfirmed
What it is

The Home Assistant Companion for iOS and macOS app up to version 2023.4 are vulnerable to Client-Side Request Forgery. Attackers may send malicious links/QRs to victims that, when visited, will make the victim to call arbitrary services in their Home Assistant installation. Combined with this security advisory, may result in full compromise and remote code execution (RCE). Version 2023.7 addresses this issue and all users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as GitHub Security Lab (GHSL) Vulnerability Report: GHSL-2023-161.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00307 · 22.3th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2023-10-19T22:02Z
EPSS history
Timeline
  • 19 OCT 22:02Z
    Client-Side Request Forgery in Home Assistant iOS/macOS native Apps
    cvelistv5