Lucene search
PRIOn knowledge basePRION:CVE-2023-46245HistoryOct 31, 2023 - 4:15 p.m.
Remote code execution
2023-10-3116:15:00
PRIOn knowledge base
www.prio-n.com
5
kimai
web-based
time-tracking
application
version 2.1.0
vulnerability
server-side template injection
ssti
remote code execution
rce
malicious user
twig file
pdf rendering
html rendering
security measures
custom templates
0.001 Low
EPSS
Percentile
40.1%
Kimai is a web-based multi-user time-tracking application. Versions prior to 2.1.0 are vulnerable to a Server-Side Template Injection (SSTI) which can be escalated to Remote Code Execution (RCE). The vulnerability arises when a malicious user uploads a specially crafted Twig file, exploiting the software’s PDF and HTML rendering functionalities. Version 2.1.0 enables security measures for custom Twig templates.
Related
cve
cve
CVE-2023-46245
2023-10-31 16:15:09
osv
osv
CVE-2023-46245
2023-10-31 16:15:09
Kimai (Authenticated) SSTI to RCE by Uploading a Malicious Twig File
2023-10-30 15:40:04
nvd
nvd
CVE-2023-46245
2023-10-31 16:15:09
github
github
Kimai (Authenticated) SSTI to RCE by Uploading a Malicious Twig File
2023-10-30 15:40:04
veracode
veracode
Remote Code Execution/Server Side Template Injection
2023-10-31 09:50:31
cvelist
cvelist