PT-2025-33680

CVE-2025-55300

Published

2025-08-12

Updated

2025-08-21

Description by

CVSS 4.0

8.6

High

MetricsAV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Komari versions prior to 1.0.4-fix1

Description: Komari is a server monitoring tool. A Cross-Site WebSocket Hijacking (CSWSH) issue exists in the WebSocket upgrader due to disabled origin checking, potentially allowing remote code execution against authenticated users. An attacker can send requests to the terminal websocket endpoint with the victim's browser cookies.

Recommendations: Update to version 1.0.4-fix1 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Imlonghao

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

CWE-1385: Missing Origin Validation in WebSockets