| Package | Affected versions | Patched versions |
|---|---|---|
| leantime/leantime | < 3.1.2 | 3.1.2 |
CSRF
A cross-site request forgery vulnerability allows a remote actor to create an account with Owner privileges. By luring an Owner or Administrator into clicking a button on an attacker-controlled website, a request will be issued, generating an account with the attacker's information and role of their choosing.
While the likelihood of a successful exploit is low, the impact would be high as the attacker could then gain complete control over the victim's environment.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free