GHSA-cv8h-r7r5-vwj9 CVE-2023-53957
Kimai contains a SameSite cookie vulnerability
- Severity
- 0.0 / 10
- High · CVSS 4.0
- Exploit chance (EPSS)
- 0.59%
- Chance of exploitation in the next 30 days. Higher than 48.33% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-1275 Sensitive Cookie with Improper SameSite Attribute
- Fix
- None yet
- No fixed version published
Description
Kimai 1.30.10 contains a SameSite cookie vulnerability that allows attackers to steal user session cookies through malicious exploitation. Attackers can trick victims into executing a crafted PHP script that captures and writes session cookie information to a file, enabling potential session hijacking.
Affected versions
Packagist
| Package | Vulnerable | Fixed in |
|---|---|---|
| kimai/kimai | <= 1.30.10 |
No fix yet |
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- User interaction
- Active
- Confidentiality (vulnerable system)
- High
- Integrity (vulnerable system)
- High
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
CVSS 3.1 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-1275: Sensitive Cookie with Improper SameSite Attribute
The SameSite attribute for sensitive cookies is not set, or an insecure value is used.
How to prevent it
- Implementation: Set the SameSite attribute of a sensitive cookie to 'Lax' or 'Strict'. This instructs the browser to apply this cookie only to same-domain requests, which provides a good Defense in Depth against CSRF attacks. When the 'Lax' value is in use, cookies are also sent for top-level cross-domain navigation via HTTP GET, HEAD, OPTIONS, and TRACE methods, but not for other HTTP methods that are more like to cause side-effects of state mutation.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-rw46-qg69-vg6h Kimai: ExportTemplate CRUD Missing Authorization Check Allows Unauthorized TEAMLEAD Access | Medium | Also affects kimai/kimai |
| GHSA-v8hx-4vx8-wc96 Kimai: Pre-2FA KIMAI_SESSION cookie grants full authenticated REST API access, bypassing TOTP | High | Also affects kimai/kimai |
| GHSA-2xgg-2x8h-8xw4 Kimai: Improper Authorization in Project, Customer, and Activity Rate Edit Endpoints Allows Cross-Scope Rate Manipulation | Medium | Also affects kimai/kimai |
| GHSA-xv4r-4885-gwpg Kimai has Improper Authorization in Team Member and Team Activity Assignment APIs Which Allows Expansion of Team Scope Beyond Authorized Visibility | Medium | Also affects kimai/kimai |
| GHSA-jr9p-4h4j-6c58 Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover | Critical | Also affects kimai/kimai |
| GHSA-r8vr-m544-qh4h Kimai: Login CSRF in the Timesheet Stop and Restart API Endpoints Allows Unauthorized State Changes | Medium | Also affects kimai/kimai |
| GHSA-c6w6-57jj-62vh Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets After Project Access Revocation | Medium | Also affects kimai/kimai |
| GHSA-3q6q-26vg-v97x Kimai: Improper Authorization Through Activity Creation with Preset Project Allows Creation Under Unauthorized Projects | Medium | Also affects kimai/kimai |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor