GHSA-427q-jp8v-ww95

ghsaUSosv

Cross-site Scripting in kimai2

view advisory published 2021-11-23Licence: CC-BY-4.0

CSRF related to duplicate action. (the duplication occurs first before redirecting to edit form). This vulnerability is capable of tricking admin users to duplicate teams.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-3976US	medium6.5	0.40% (34th)	—	2021-11-19
kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)

references

External citations — patches, advisories, analysis.

https://github.com/kevinpapst/kimai2/commit/b28e9c120c87222e21a238f1b03a609d6a5d506eWEB
https://huntr.dev/bounties/0567048a-118c-42ec-9f94-b55533017406WEB
https://nvd.nist.gov/vuln/detail/CVE-2021-3976ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan