GitHub Advisoryadvisory · Packagist

GHSA-92xh-6x7v-4rmq Leantime allows Cross-Site Request Forgery (CSRF)

MEDIUM Published 2025-02-21 Modified 2025-02-21 Official page ↗
Ecosystem
Packagist
Packages
leantime/leantime
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-352
Reviewed
2025-02-21

Affected packages

• Packagist leantime/leantime: < 3.1.2 → fixed in 3.1.2

Description

CSRF Summary A cross-site request forgery vulnerability allows a remote actor to create an account with Owner privileges. By luring an Owner or Administrator into clicking a button on an attacker-controlled website, a request will be issued, generating an account with the attacker's information and role of their choosing. Impact While the likelihood of a successful exploit is low, the impact would be high as the attacker could then gain complete control over the victim's environment.

Related

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References