GitHub Advisoryadvisory · Packagist

GHSA-c39w-3pjx-qc7m Leantime allows Stored Cross-Site Scripting (XSS)

HIGH Published 2025-02-21 Modified 2025-02-21 Official page ↗
Ecosystem
Packagist
Packages
leantime/leantime
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-79
Reviewed
2025-02-21

Affected packages

• Packagist leantime/leantime: < 3.3 → fixed in 3.3

Description

Description Leantime allows stored cross-site scripting (XSS) in the API key name while generating the API key. Impact Any low privileged user like manager, or editor, can create an API key with XSS payload. When admin will visit the Company page, the XSS will automatically get triggerred leading to the unauthorized action performed from the ADMIN account. Like, removing any user, or adding someone else as high privilege, and many more.

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References