HIGH🇬🇧 English

CVE-2021-43515

CVSS 7.8v3.1pub. 2022-04-08upd. 2024-11-21

CSV Injection (aka Excel Macro Injection or Formula Injection) exists in creating new timesheet in Kimai. By filling the Description field with malicious payload, it will be mistreated while exporting to a CSV file.

oryginał EN
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

  • Kimai

    APP
    Kimai
    < 1.14.1
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
CWE
Referencje

Powiązane podatności

CVE-2020-19825CRITICAL9.6ten sam produkt

Cross Site Scripting (XSS) vulnerability in kevinpapst kimai2 1.30.0 in /src/Twig/Runtime/MarkdownExtension.ph...

CVE-2023-53957HIGH8.5ten sam produkt

Kimai 1.30.10 contains a SameSite cookie vulnerability that allows attackers to steal user session cookies thr...

CVE-2023-46245HIGH7.2ten sam produkt

Kimai is a web-based multi-user time-tracking application. Versions prior to 2.1.0 are vulnerable to a Server-...

CVE-2026-42267MEDIUM5.4ten sam produkt

Kimai is an open-source time tracking application. From version 2.27.0 to before version 2.54.0, any ROLE_USER...

CVE-2026-44298MEDIUM4.1ten sam produkt

Kimai is an open-source time tracking application. From version 2.32.0 to before version 2.56.0, users with th...