~ / search / GHSA-cv8h-r7r5-vwj9

GHSA-cv8h-r7r5-vwj9

Kimai contains a SameSite cookie vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2023-53957

Packages

EcosystemPackageAffectedFixed in
Packagist kimai/kimai <= 1.30.10 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Kimai 1.30.10 contains a SameSite cookie vulnerability that allows attackers to steal user session cookies through malicious exploitation. Attackers can trick victims into executing a crafted PHP script that captures and writes session cookie information to a file, enabling potential session hijacking.

References

External links from the advisory. They lead to third-party sites.