GitHub Advisoryadvisory · Packagist

GHSA-9w8f-7wgr-2h7g kimai2 is vulnerable to Improper Access Control

MEDIUM Published 2021-12-03 Modified 2021-12-03 Official page ↗
Aliases
CVE-2021-3992
Ecosystem
Packagist
Packages
kevinpapst/kimai2
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-284, CWE-639, CWE-863
Reviewed
2021-12-03

Affected packages

• Packagist kevinpapst/kimai2: < 1.16.3 → fixed in 1.16.3

Description

kimai2 is vulnerable to Improper Access Control

Related

Alias · CVE (1)

  • CVE-2021-3992 kimai2 is vulnerable to Improper Access Control vulnerability

Weakness · CWE (3)

  • CWE-284 Improper Access Control weakness
  • CWE-639 Authorization Bypass Through User-Controlled Key weakness
  • CWE-863 Incorrect Authorization weakness

References