GitHub Advisoryadvisory · Packagist

GHSA-427q-jp8v-ww95 Cross-site Scripting in kimai2

MEDIUM Published 2021-11-23 Modified 2021-11-22 Official page ↗
Aliases
CVE-2021-3976
Ecosystem
Packagist
Packages
kevinpapst/kimai2
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weaknesses
CWE-352
Reviewed
2021-11-22

Affected packages

• Packagist kevinpapst/kimai2: < 1.16.2 → fixed in 1.16.2

Description

CSRF related to duplicate action. (the duplication occurs first before redirecting to edit form). This vulnerability is capable of tricking admin users to duplicate teams.

Related

Alias · CVE (1)

  • CVE-2021-3976 kimai2 is vulnerable to Cross-Site Request Forgery (CSRF) vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References