Vulnerability GHSA-3hfj-qcvj-4hx8
Low Risk
LOW RISK
CVSS Score: 3.0
Score Range: < 4.0
Low severity vulnerabilities (CVSS < 4.0). Hygiene issues that can accumulate but pose lower immediate risk.
1 year ago
February 21, 2025 at 11:53 PM UTC
Leantime has Missing Authorization Check for Host Parameter
2.0 - 3.2.1
2.0 - 3.2.1
Summary
Leantime has Missing Authorization Check for Host Parameter
Details
Finding Description
Application has functionality for a user to view profile information. It does not have an implemented authorization check for "Host" parameter which allows a user to view profile information of another user by replacing "Host" parameter.
Impact
By exploiting this vulnerability an attacker can able to view profile information (but not anything else or change anything)
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
6 hours ago
Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods
2.0 - 3.9.8 GHSA-54mm-6729-r5wp
2.0 - 3.9.8 GHSA-54mm-6729-r5wp
Medium Risk
7 months ago
Leantime has HTML injection through firstname and lastname fields
2.0 - 3.3 GHSA-qrfh-cc86-vc8c
2.0 - 3.3 GHSA-qrfh-cc86-vc8c
Low Risk
1 year ago
Leantime allows Cross-Site Scripting (XSS)
2.0 - 3.2.1 GHSA-f679-254h-qhvj
2.0 - 3.2.1 GHSA-f679-254h-qhvj
Medium Risk
1 year ago
Leantime affected by Improper Neutralization of HTML Tags
2.0 - 3.2.1 GHSA-95j3-435g-vjcp
2.0 - 3.2.1 GHSA-95j3-435g-vjcp
High Risk
1 year ago
Leantime allows Stored Cross-Site Scripting (XSS)
2.0 - 3.2.1 GHSA-c39w-3pjx-qc7m
2.0 - 3.2.1 GHSA-c39w-3pjx-qc7m
Impacted packages
Timeline
Published
1 year ago
February 21, 2025 at 11:53 PM UTC
Fixed (3.3)
1 year ago
November 16, 2024 at 03:17 PM UTC
Last Modified
1 year ago
February 22, 2025 at 12:15 AM UTC