medium4.6
CVE-2021-3957
Cross-site Scripting in kimai2
Impact
Cross site request forgery vulnerability is present in delete functionality of doctor feature. This vulnerability is capable of deleting system logs
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | kevinpapst/kimai2 | < 1.16 | 1.16 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Kimai | Kimai 2 | before 1.16.2 |