Leantime has Missing Authorization Check for Host Parameter

LOWGHSA-3hfj-qcvj-4hx8 · Published 21/02/2025 · updated 22/02/2025

In short

GHSA-3hfj-qcvj-4hx8 is a LOW vulnerability affecting leantime/leantime.
Fix: update to 3.3 or later.

Package	Affected versions	Patched versions
leantime/leantime Packagist	`< 3.3`	`3.3`

Description

Finding Description

Application has functionality for a user to view profile information. It does not have an implemented authorization check for "Host" parameter which allows a user to view profile information of another user by replacing "Host" parameter.

Impact

By exploiting this vulnerability an attacker can able to view profile information (but not anything else or change anything)

References

Leantime/leantime security advisory · WEB
Leantime/leantime · PACKAGE

More vulnerabilities in leantime/leantime

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free