~ / search / GHSA-427q-jp8v-ww95

GHSA-427q-jp8v-ww95

Cross-site Scripting in kimai2

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-3976

Packages

EcosystemPackageAffectedFixed in
Packagist kevinpapst/kimai2 < 1.16.2 1.16.2

Details

As written in the advisory (Markdown source, shown as plain text).

CSRF related to duplicate action. (the duplication occurs first before redirecting to edit form). This vulnerability is capable of tricking admin users to duplicate teams.

References

External links from the advisory. They lead to third-party sites.