GitHub Advisoryadvisory · Packagist

GHSA-h6w8-27ph-c385 Leantime has Insufficiently Protected Credentials

MEDIUM Published 2025-02-21 Modified 2025-02-21 Official page ↗
Ecosystem
Packagist
Packages
leantime/leantime
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-522
Reviewed
2025-02-21

Affected packages

• Packagist leantime/leantime: < 3.3 → fixed in 3.3

Description

Due to improper cache control an attacker can view sensitive information even if they are not logged into the account anymore. Additional Information: 1.The issue was identified during routine security testing. 2.This vulnerability poses a significant risk to user privacy and data security. 3.Urgent action is recommended to mitigate this vulnerability and protect user data from unauthorized access.

Related

Weakness · CWE (1)

  • CWE-522 Insufficiently Protected Credentials weakness

References