En bref
- CVE-2019-25317 est une vulnérabilité MOYENNE (CVSS 5.4) touchant kimai/kimai, kimai (kimai).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.30%, plus élevée que 23.0% des vulnérabilités.
- Correctif : mettre à jour vers 1.1 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| kimai/kimai Packagist | < 1.1
| 1.1
|
| kimai | ≤ 1.1
| No fix yet |
Description
Kimai 2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into timesheet descriptions. Attackers can insert SVG-based XSS payloads in the description field to execute arbitrary JavaScript when the page is loaded and viewed by other users.
NVD description
Kimai 2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into timesheet descriptions. Attackers can insert SVG-based XSS payloads in the description field to execute arbitrary JavaScript when the page is loaded and viewed by other users.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free