Vulnerability GHSA-c39w-3pjx-qc7m
High Risk
HIGH RISK
CVSS Score: 8.0
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
1 year ago
February 21, 2025 at 10:48 PM UTC
Leantime allows Stored Cross-Site Scripting (XSS)
2.0 - 3.2.1
2.0 - 3.2.1
Summary
Leantime allows Stored Cross-Site Scripting (XSS)
Details
Description
Leantime allows stored cross-site scripting (XSS) in the API key name while generating the API key.
Impact
Any low privileged user like manager, or editor, can create an API key with XSS payload. When admin will visit the Company page, the XSS will automatically get triggerred leading to the unauthorized action performed from the ADMIN account. Like, removing any user, or adding someone else as high privilege, and many more.
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
6 hours ago
Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods
2.0 - 3.9.8 GHSA-54mm-6729-r5wp
2.0 - 3.9.8 GHSA-54mm-6729-r5wp
Medium Risk
7 months ago
Leantime has HTML injection through firstname and lastname fields
2.0 - 3.3 GHSA-qrfh-cc86-vc8c
2.0 - 3.3 GHSA-qrfh-cc86-vc8c
Low Risk
1 year ago
Leantime allows Cross-Site Scripting (XSS)
2.0 - 3.2.1 GHSA-f679-254h-qhvj
2.0 - 3.2.1 GHSA-f679-254h-qhvj
Medium Risk
1 year ago
Leantime affected by Improper Neutralization of HTML Tags
2.0 - 3.2.1 GHSA-95j3-435g-vjcp
2.0 - 3.2.1 GHSA-95j3-435g-vjcp
Low Risk
1 year ago
Leantime has Missing Authorization Check for Host Parameter
2.0 - 3.2.1 GHSA-3hfj-qcvj-4hx8
2.0 - 3.2.1 GHSA-3hfj-qcvj-4hx8
Impacted packages
Timeline
Published
1 year ago
February 21, 2025 at 10:48 PM UTC
Fixed (3.3)
1 year ago
November 16, 2024 at 03:17 PM UTC
Last Modified
1 year ago
February 21, 2025 at 11:12 PM UTC