CVE-2024-29200
Medium
Description
Kimai is a web-based multi-user time-tracking application. The permission `view_other_timesheet` performs differently for the Kimai UI and the API, thus returning unexpected data through the API. When setting the `view_other_timesheet` permission to true, on the frontend, users can only see timesheet entries for teams they are a part of. When requesting all timesheets from the API, however, all timesheet entries are returned, regardless of whether the user shares team permissions or not. This vulnerability is fixed in 2.13.0.
SeverityMedium
CVSS6.8
Exploit probability—
ProductKimai
PublishedMar 28, 2024
First seenMar 28, 2024
Weakness typeCWE-1220CWE-1220
How to fix
Update
- kimai kimai2.13.0 or later
- kimai/kimai2.13.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| kimai kimai | v < 2.13.0 | 2.13.0 |
| kimai/kimaiPackagist | v < 2.13.0 | 2.13.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.