GitHub Advisoryadvisory · Packagist

GHSA-3hfj-qcvj-4hx8 Leantime has Missing Authorization Check for Host Parameter

LOW Published 2025-02-21 Modified 2025-02-21 Official page ↗
Ecosystem
Packagist
Packages
leantime/leantime
Severity
Low
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-862
Reviewed
2025-02-21

Affected packages

• Packagist leantime/leantime: < 3.3 → fixed in 3.3

Description

Finding Description Application has functionality for a user to view profile information. It does not have an implemented authorization check for "Host" parameter which allows a user to view profile information of another user by replacing "Host" parameter. Impact By exploiting this vulnerability an attacker can able to view profile information (but not anything else or change anything)

Related

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References