Log in Start free

Vulnerability · Published May 7, 2024 · Assigned by VulDB

CVE-2024-4596Kimai Session information disclosure

Low 3.7

In plain English

A low-severity information exposure in Kimai. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.7Low
Exploit odds (30 days)0.8%top 43.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability was found in Kimai up to 2.15.0 and classified as problematic. Affected by this issue is some unknown functionality of the component Session Handler. The manipulation of the argument PHPSESSIONID leads to information disclosure. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. Upgrading to version 2.16.0 is able to address this issue. It is recommended to upgrade the affected component. VDB-263318 is the identifier assigned to this vulnerability.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagistkimai/kimai2.16.0GHSA-6f3v-2r2j-2rpr

Affected products (as reported)

VendorProductVersions
n/a Kimai 2.02.12.22.32.42.52.62.7

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

References