medium6.5
CVE-2021-4033
Cross-Site Request Forgery in kimai2
Impact
CSRF in saving invoices / modifying status of invoices (pending and cancel only)
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | kevinpapst/kimai2 | < 1.16.7 | 1.16.7 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Kimai | Kimai 2 | before 1.16.7 |