MEDIUM4.3

GHSA-427q-jp8v-ww95

Cross-site Scripting in kimai2

Quick fix

GHSA-427q-jp8v-ww95 — kevinpapst/kimai2: upgrade to the fixed version with the command below.

composer require kevinpapst/kimai2:^1.16.2

Details

CSRF related to duplicate action. (the duplication occurs first before redirecting to edit form). This vulnerability is capable of tricking admin users to duplicate teams.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/kevinpapst/kimai2

Introduced in: 0Fixed in: 1.16.2

Fixcomposer require kevinpapst/kimai2:^1.16.2

References

https://nvd.nist.gov/vuln/detail/CVE-2021-3976[ADVISORY]
https://github.com/kevinpapst/kimai2/commit/b28e9c120c87222e21a238f1b03a609d6a5d506e[WEB]
https://huntr.dev/bounties/0567048a-118c-42ec-9f94-b55533017406[WEB]