GitStock

leantime/leantime · Security

Leantime allows Stored Cross-Site Scripting (XSS)

Open GitHub
GHSA ID
GHSA-c39w-3pjx-qc7m
Severity
high
Published
Updated
CVSS v4
7.6 · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Description

Description

Leantime allows stored cross-site scripting (XSS) in the API key name while generating the API key.

Impact

Any low privileged user like manager, or editor, can create an API key with XSS payload. When admin will visit the Company page, the XSS will automatically get triggerred leading to the unauthorized action performed from the ADMIN account. Like, removing any user, or adding someone else as high privilege, and many more.

CWEs

  • CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

References