medium4.3
CVE-2021-3963
Cross-site Scripting in kimai2
Impact
kimai2 is vulnerable to Cross-Site Request Forgery (CSRF) in deleting invoice templates. This vulnerability is capable of tricking admin user to delete invoice templates.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | kevinpapst/kimai2 | < 1.16 | 1.16 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Kimai | Kimai 2 | before 1.16.2 |