Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
veracodeVeracode Vulnerability DatabaseVERACODE:46114
HistoryApr 01, 2024 - 6:54 a.m.

Insufficient Access Control

2024-04-0106:54:11
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
11
kimai vulnerability granularity timesheet unauthorized access

6.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

6.8 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.0%

JSON

Kimai is vulnerable to Insufficient Granularity of Access Control. This vulnerability is due to the view_other_timesheet permission between the UI and API performing differently, leading to unauthorized access to timesheet entries.

CPENameOperatorVersion
kimai/kimaile2.12.0
kimai/kimaile2.12.0

Related

github 1
cve 1
osv 1
cvelist 1
nvd 1
github
github
Kimai API returns timesheet entries a user should not be authorized to view
2024-03-29 19:05:49
cve
cve
CVE-2024-29200
2024-03-28 14:15:14
osv
osv
Kimai API returns timesheet entries a user should not be authorized to view
2024-03-29 19:05:49
cvelist
cvelist
CVE-2024-29200 API returns timesheet entries a user should not be authorized to view
2024-03-28 13:28:36
nvd
nvd
CVE-2024-29200
2024-03-28 14:15:14

6.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

6.8 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.0%

JSON
Related for VERACODE:46114
github1cve1osv1cvelist1nvd1