Leantime has Missing Authorization Check for Host Parameter

BAJOGHSA-3hfj-qcvj-4hx8 · Published 21/02/2025 · updated 22/02/2025

En resumen

GHSA-3hfj-qcvj-4hx8 es una vulnerabilidad BAJO que afecta a leantime/leantime.
Solución: actualizar a 3.3 o posterior.

Package	Affected versions	Patched versions
leantime/leantime Packagist	`< 3.3`	`3.3`

Description

Finding Description

Application has functionality for a user to view profile information. It does not have an implemented authorization check for "Host" parameter which allows a user to view profile information of another user by replacing "Host" parameter.

Impact

By exploiting this vulnerability an attacker can able to view profile information (but not anything else or change anything)

References

Leantime/leantime security advisory · WEB
Leantime/leantime · PACKAGE

Más vulnerabilidades de leantime/leantime

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free