CVE-2024-29200

Katalog CVE

CVSS 6.5 · Medium EPSS 0,64%

Kerentanan Insufficient Granularity of Access Control pada kimai. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Kimai is a web-based multi-user time-tracking application. The permission `view_other_timesheet` performs differently for the Kimai UI and the API, thus returning unexpected data through the API. When setting the `view_other_timesheet` permission to true, on the frontend, users can only see timesheet entries for teams they are a part of. When requesting all timesheets from the API, however, all timesheet entries are returned, regardless of whether the user shares team permissions or not. This vulnerability is fixed in 2.13.0.

Rincian

Terbit di NVD

28 Maret 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1220: Insufficient Granularity of Access Control

EPSS (30 hari)

0,64% peluang dieksploitasi; lebih tinggi dari 49,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/kimai/kimai/security/advisories/GHSA-cj3c-5xpm-cx94 exploit · advisory vendor