Cross-Site Request Forgery (CSRF)

2021-12-1008:26:29

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

kevinpapst/kimai2

cross-site request forgery

invoicecontroller.php

createinvoiceaction

invoice tracking

EPSS

0.001

Percentile

31.3%

JSON

kevinpapst/kimai2 is vulnerable to cross-site request forgery. The vulnerability exists in createInvoiceAction of InvoiceController.php which allows a malicious attacker to trick users to modify status of invoices and disrupt the tracking of invoices.