MEDIUM4.3

GHSA-gf2c-93hm-r9j5

Cross-site Scripting in kimai2

Quick fix

GHSA-gf2c-93hm-r9j5 — kevinpapst/kimai2: upgrade to the fixed version with the command below.

composer require kevinpapst/kimai2:^1.16

Details

kimai2 is vulnerable to Cross-Site Request Forgery (CSRF) in deleting invoice templates. This vulnerability is capable of tricking admin user to delete invoice templates.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/kevinpapst/kimai2

Introduced in: 0Fixed in: 1.16

Fixcomposer require kevinpapst/kimai2:^1.16

References

https://nvd.nist.gov/vuln/detail/CVE-2021-3963[ADVISORY]
https://github.com/kevinpapst/kimai2/commit/95796ab2560ad93f44068a88f0fad758c2053514[WEB]
https://huntr.dev/bounties/3abf308b-7dbd-4864-b1a9-5c45b876def8[WEB]